| Package | Affected versions | Patched versions |
|---|---|---|
| xt-commerce | ≥ 5.1.0, ≤ 6.2.2 |
The address-management feature in xt:Commerce 5.1 to 6.2.2 allows remote authenticated users to zero out other user's stored addresses by manipulating an id field in the POST request for altering an address.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free