CVE-2023-40281

Summary

CVE-2023-40281 is a cross-site scripting (XSS) vulnerability affecting EC-CUBE versions 2.11.0 to 2.17.2-p1. This issue exists in the "mail/template" and "products/product" sections of the Management page. If successfully exploited, an attacker could inject malicious scripts that would be executed in the web browsers of other administrators or users, potentially leading to unauthorized access or data theft.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.