CVE-2021-20744

2021-06-2201:35:58

jpcert

www.cve.org

cve-2021-20744

ec-cube

category contents plugin

cross-site scripting

remote attacker

arbitrary script

administrator

user

specially crafted page

EPSS

0.001

Percentile

47.2%

JSON

Cross-site scripting vulnerability in EC-CUBE Category contents plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.1 allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation.

CNA Affected

[
  {
    "product": "EC-CUBE Category contents plugin (for EC-CUBE 3.0 series)",
    "vendor": "EC-CUBE CO.,LTD.",
    "versions": [
      {
        "status": "affected",
        "version": "versions prior to version 1.0.1"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN57524494/index.html

www.ec-cube.net/products/detail.php?product_id=1070

EPSS

0.001

Percentile

47.2%

JSON

Related for CVELIST:CVE-2021-20744