CVE-2024-58304

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-58304

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-58304.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-58304

Published

2025-12-11T21:40:42Z

Modified

2026-10-02T03:30:19Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

SPA-CART CMS < 2.0.0 Stored Cross-Site Scripting

Details

SPA-CART CMS before 2.0.0 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticated administrators to inject malicious scripts. Attackers can submit JavaScript payloads through the 'descr' parameter in the product edit form to execute arbitrary code in administrative users' browsers.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58304.json"
}

References

Affected packages

Git / github.com/olegkhorev/php-spa-cart

Affected ranges

Type

GIT

Repo

https://github.com/olegkhorev/php-spa-cart

Events

Introduced

Fixed

4958f73b5f39b49dca45d504b0a4861fc92cc297

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.0.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

Other

new_version

v1.*

v1.9.1.4

v1.9.1.5

v1.9.1.7

v1.9.2

v2.*

v2.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-58304.json"