CVE-2023-40281

Published: Aug 17, 2023Modified: Jun 17, 2026

4.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.7 / Impact: 2.7

Source: NVD

Description

EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the product.

Affected (8)

Products: Ec Cube: Ec Cube

Ec Cube

1 product

Ec Cube

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Ec Cube Ec Cube	From 2.11.0 to 2.11.5
Ec Cube Ec Cube	From 2.12.0 to 2.12.6
Ec Cube Ec Cube	From 2.13.0 to 2.13.5
Ec Cube Ec Cube	From 2.17.0 to 2.17.2
Ec Cube Ec Cube	Version 2.13.5
Ec Cube Ec Cube	Version 2.13.5 patch1
Ec Cube Ec Cube	Version 2.17.2
Ec Cube Ec Cube	Version 2.17.2 patch1