CVE-2014-4965

NONE EPSS 86.8%

Published Jul 15, 201411y ago · Modified Jun 17, 20262w ago

Published Jul 15, 2014 11y ago

Last Modified Jun 17, 2026 2w ago

Description

Multiple cross-site scripting (XSS) vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) customername parameter to central/orders/searchcriteria.action; (2) productname, (3) availability, or (4) status parameter to central/catalog/productlist.action; or unspecified vectors in (5) WebContent/orders/orderlist.jsp.

Threat Intelligence

EPSS Exploit Probability

86.8% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

Vendor	Product	Version	Range
shopizer	shopizer	*	≤1.1.5

References 3

seclists.org http://seclists.org/fulldisclosure/2014/Jul/38

Exploit
securityfocus.com http://www.securityfocus.com/archive/1/532726/100/0/threaded
exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/94465

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.