CVE-2025-47289

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-47289
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-47289.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-47289
Aliases
  • GHSA-98qq-m8qj-vvgj
Published
2025-06-02T11:00:20.730Z
Modified
2026-03-14T12:43:24.043039Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Stored XSS in CE Phoenix Cart Testimonials Allows Account Takeover if Missing HttpOnly Flag
Details

CE Phoenix is a free, open-source eCommerce platform. A stored cross-site scripting (XSS) vulnerability was discovered in CE Phoenix versions 1.0.9.9 through 1.1.0.2 where an attacker can inject malicious JavaScript into the testimonial description field. Once submitted, if the shop owner (admin) approves the testimonial, the script executes in the context of any user visiting the testimonial page. Because the session cookies are not marked with the HttpOnly flag, they can be exfiltrated by the attacker — potentially leading to account takeover. Version 1.1.0.3 fixes the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47289.json",
    "cwe_ids": [
        "CWE-1004"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/ce-phoenixcart/phoenixcart

Affected ranges

Type
GIT
Repo
https://github.com/ce-phoenixcart/phoenixcart
Events
Introduced
71ff16821bdbda52238b2276f094cbcdf4cba7d6
Fixed
1c1c329923c42357cde210ec50859b1150740cbc

Affected versions

v1.*
v1.0.9.10
v1.0.9.7
v1.0.9.8
v1.0.9.9
v1.1.0.0
v1.1.0.1
v1.1.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-47289.json"