EUVD-2026-41679
GHSA-mc49-c33w-7xvv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint with no auth required; scope changes to victim browser; UI:R because victim must view poisoned content for XSS to fire.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was determined in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 49b20f53de2b7ec34e920b11c863f1491d911a04. This affects an unknown part of the file /index.php/api/product/set of the component Hidden REST API Endpoint. This manipulation of the argument title/description causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. Patch name: d9785f995da77bdc62fb2d34bad5f7a162c9ad23. To fix this issue, it is recommended to deploy a patch.
AnalysisAI
Stored cross-site scripting in kirilkirkov's Ecommerce-CodeIgniter-Bootstrap allows remote unauthenticated attackers to inject malicious scripts via the title or description arguments of the hidden REST API endpoint /index.php/api/product/set, executing arbitrary JavaScript in the browsers of users who subsequently view the affected product data. A public exploit has been disclosed (CVSS 4.0 E:P), though the low CVSS 4.0 score of 2.1 and the user-interaction requirement constrain practical impact. No active exploitation is confirmed by CISA KEV, and a patch commit is available in the project repository.
Technical ContextAI
The affected application is an open-source PHP e-commerce platform built on the CodeIgniter MVC framework with a Bootstrap frontend, hosted on GitHub under kirilkirkov/Ecommerce-CodeIgniter-Bootstrap. The vulnerability class is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied data passed through the title or description parameters to the /index.php/api/product/set REST API endpoint is not properly sanitized or encoded before being reflected or persisted and later rendered in HTML. The endpoint is described as a 'hidden' REST API, suggesting it may not be prominently documented, yet remains externally reachable. Because the application operates on a rolling release model, no discrete version numbers demarcate affected versus unaffected releases; exposure is defined by whether the deployed commit precedes the fix commit d9785f995da77bdc62fb2d34bad5f7a162c9ad23.
RemediationAI
The primary fix is to apply patch commit d9785f995da77bdc62fb2d34bad5f7a162c9ad23, available at https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/d9785f995da77bdc62fb2d34bad5f7a162c9ad23, which addresses the improper output encoding in the product set endpoint. The corresponding GitHub Security Advisory (GHSA-8q62-q8qx-j49g) should be consulted for additional context. Because no tagged release exists, operators should pull the patched commit directly and verify the fix is present in their deployed code. If immediate patching is not possible, a compensating control would be to restrict access to the /index.php/api/product/set endpoint via web server ACLs or a WAF rule blocking requests to that path from untrusted sources - note this may disrupt legitimate product management workflows if the endpoint is used by authorized processes. Additionally, enforcing a Content-Security-Policy header and ensuring HttpOnly and Secure flags are set on session cookies limits the exploitability of any residual XSS vectors.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today