Description

Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted request to the ProductGrid function in admin/productGrid/Grid.jsx.

Remediation

References

https://devhub.checkmarx.com/cve-details/CVE-2023-46494/

https://devhub.checkmarx.com/cve-details/Cx8ecec391-2014/

Related Vulnerabilities

CVE-2023-26109 Vulnerability in npm package node-bluetooth-serial-port

CVE-2010-2245 Vulnerability in maven package org.apache.wink:wink-assembly-aggregatejar-osgi

CVE-2022-37265 Vulnerability in npm package steal

CVE-2023-43498 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2018-14041 Vulnerability in npm package bootstrap

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Third Party Advisory Not Applicable