EUVD-2026-37683Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N
Admin authentication required (PR:H) and victim must load the page (UI:R); scope changes (S:C) because payload executes in other users' browsers, with limited confidentiality and integrity impact on those victims.
Primary rating from Vendor (Checkmarx).
CVSS VectorVendor: Checkmarx
Lifecycle Timeline
2DescriptionCVE.org
Stored cross-site scripting (XSS) in NewsItemApiController In SimplCommerce prior to commit 6142d3b5 allows an authenticated administrator to execute arbitrary JavaScript via the ShortContent and FullContent fields, which are stored without HTML sanitization and rendered unencoded via @Html.Raw()
AnalysisAI
Stored XSS in SimplCommerce's news module allows an authenticated administrator to persist arbitrary JavaScript via the ShortContent and FullContent fields of NewsItemApiController, which are stored without HTML sanitization and rendered unencoded through Razor's @Html.Raw() method. Any site visitor who subsequently loads an affected news page will execute the injected script in their browser, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing exists at time of analysis; an upstream fix is available at commit 6142d3b5 per Checkmarx's disclosure.
Technical ContextAI
SimplCommerce is an ASP.NET Core e-commerce platform. The vulnerability resides in NewsItemApiController.cs within the SimplCommerce.Module.News module (CPE: cpe:2.3:a:simplcommerce:simplcommerce:*:*:*:*:*:*:*:*). Both the Post and Put action methods assign the ShortContent and FullContent form fields directly to model properties without any HTML sanitization, and the Razor views render these fields via @Html.Raw(), which explicitly bypasses ASP.NET Core's default output encoding. This is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) stored-XSS root cause: untrusted HTML-capable input persists in the database and is later reflected into the DOM without escaping. The fix, introduced in PR #1151, adds the Ganss.Xss HtmlSanitizer package (version 9.0.892) and wraps both field assignments with _htmlSanitizer.Sanitize() calls in both the Post and Put handlers.
RemediationAI
Upgrade SimplCommerce to a build that incorporates commit 6142d3b5 or later, available at https://github.com/simplcommerce/SimplCommerce/commit/6142d3b5147899e0edb41663ae20183878ab39f7. The patch adds HtmlSanitizer 9.0.892 (Ganss.Xss) and applies it to ShortContent and FullContent in both Post and Put handlers of NewsItemApiController; no specific tagged release version has been independently confirmed as the exact fix boundary, so verify the commit is present in your build. If an immediate upgrade is not feasible, restrict administrative access to only fully trusted internal accounts and deploy a strict Content-Security-Policy header that blocks inline script execution (e.g., script-src 'self') - note this may break legitimate rich-text editor functionality and requires testing. Additionally, audit all existing news items in the database for stored malicious payloads, since the code fix does not retroactively sanitize previously persisted content; any such content must be manually cleaned or re-sanitized.
More in Simplcommerce
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today