CVE-2025-1746CWE-79

Cross-Site Scripting vulnerability in OpenCart

Medium · published February 28, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
13.4
In the wild
Unconfirmed
What it is

Cross-Site Scripting vulnerability in OpenCart versions prior to 4.1.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the search in the /product/search endpoint. This vulnerability could be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00233 · 13.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-02-28T13:38Z
EPSS history
Timeline
  • 28 FEB 13:38Z
    Cross-Site Scripting vulnerability in OpenCart
    cvelistv5