Cross site scripting in Shopizer

MEDIO 4.8CVE-2022-23059 · GHSA-p2j7-6g9h-32xh · Published 29/03/2022 · updated 17/06/2026

En resumen

CVE-2022-23059 es una vulnerabilidad MEDIO (CVSS 4.8) que afecta a com.shopizer:shopizer, shopizer (shopizer).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.62%, mayor que el 50.0% de las vulnerabilidades.
Solución: actualizar a 3.0.0 o posterior.

Package	Affected versions	Patched versions
com.shopizer:shopizer Maven	`≥ 2.0.2, < 3.0.0`	`3.0.0`
shopizer shopizer	`≥ 2.0, ≤ 2.17.0`	No fix yet

Description

A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions v2.0.2 through v2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code.

NVD description

A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code.

References

nvd.nist.gov/vuln/detail/CVE-2022-23059 · ADVISORY
shopizer-ecommerce/shopizer commit 6b9f1ec · WEB
shopizer-ecommerce/shopizer · PACKAGE
whitesourcesoftware.com/vulnerability-database/CVE-2022-23059 · WEB

Más vulnerabilidades de com.shopizer:shopizer

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.shopizer:shopizer

Maven

≥ 2.0.2, < 3.0.0

3.0.0

shopizer

≥ 2.0, ≤ 2.17.0

No fix yet

Description

NVD description

Más vulnerabilidades de com.shopizer:shopizer

Ver todo →