by Kastro
Paper/Archive/CVE-2020-11006

CVE-2020-11006

shopizer-ecommerce shopizer — Potential remote code execution in Shopizer

EPSS 0.6%CVSS 9.1
critical.is priorityof 100
37
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 50.2.502 × 2010.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In Shopizer before version 2.11.0, a script can be injected in various forms and saved in the database, then executed when information is fetched from backend. This has been patched in version 2.11.0.

Affected

ProductAffectedFixed inSource
shopizer< 2.11.0–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

References

refgithub.com/shopizer-ecommerce/shopizer/commit/929ca0839a80c6f4dad087e0259089908787ad2arefgithub.com/shopizer-ecommerce/shopizer/security/advisories/GHSA-8pc4-gvfw-634p