Cloud Web Application
Monthly
Stored cross-site scripting in TPVEnlanube enables an authenticated backend user to store malicious JavaScript in the 'Apellido 1' field of the Joomla/VirtueMart administrator user-add endpoint '/administrator/index.php?page=admin.user_add&user_id=45&option=com_virtuemart'; the payload executes in the browser of a privileged user or administrator who later views the affected user record. The flaw is not self-triggering and requires two actors-an authenticated low-privileged account to store the payload and an administrator to render it-so the assessed impact is low-to-moderate, limited to script execution in the victim's admin session, with no public exploit identified at time of analysis and no direct server-side code execution.
Stored cross-site scripting (XSS) in TPVEnlanube, a Joomla/VirtueMart payment gateway extension, allows an authenticated attacker to inject malicious script into the 'Nombre Completo' field, which then executes in the browser of any privileged user viewing the VirtueMart administrator user-list page (admin.user_list). The vulnerability affects all versions of the extension (CPE wildcard) and requires the victim to interact with the page. No public exploit has been identified, and the overall risk is assessed as low-to-moderate due to the need for authentication and user interaction, with impact limited to browser-based script execution rather than server compromise.
Stored cross-site scripting in TPVEnlanube allows an authenticated user with access to the VirtueMart store administration function to persist arbitrary script through the 'vendor_store_name' parameter at the '/administrator/index.php?pshop_mode=admin&page=store.store_add&option=com_virtuemart&vendor_id=[ID]' endpoint; the payload then executes in the browser of any administrator or user who later renders the poisoned store record. Exploitation is high-friction: it requires valid backend credentials (CVSS PR:L), reachability of the store-management feature, and a separate privileged victim who opens the affected record (UI:A), which caps the realistic impact at low-confidentiality/low-integrity for the victim's session. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; severity is low (CVSS 4.0 base 4.8).
Stored cross-site scripting in TPVEnlanube enables an authenticated backend user to store malicious JavaScript in the 'Apellido 1' field of the Joomla/VirtueMart administrator user-add endpoint '/administrator/index.php?page=admin.user_add&user_id=45&option=com_virtuemart'; the payload executes in the browser of a privileged user or administrator who later views the affected user record. The flaw is not self-triggering and requires two actors-an authenticated low-privileged account to store the payload and an administrator to render it-so the assessed impact is low-to-moderate, limited to script execution in the victim's admin session, with no public exploit identified at time of analysis and no direct server-side code execution.
Stored cross-site scripting (XSS) in TPVEnlanube, a Joomla/VirtueMart payment gateway extension, allows an authenticated attacker to inject malicious script into the 'Nombre Completo' field, which then executes in the browser of any privileged user viewing the VirtueMart administrator user-list page (admin.user_list). The vulnerability affects all versions of the extension (CPE wildcard) and requires the victim to interact with the page. No public exploit has been identified, and the overall risk is assessed as low-to-moderate due to the need for authentication and user interaction, with impact limited to browser-based script execution rather than server compromise.
Stored cross-site scripting in TPVEnlanube allows an authenticated user with access to the VirtueMart store administration function to persist arbitrary script through the 'vendor_store_name' parameter at the '/administrator/index.php?pshop_mode=admin&page=store.store_add&option=com_virtuemart&vendor_id=[ID]' endpoint; the payload then executes in the browser of any administrator or user who later renders the poisoned store record. Exploitation is high-friction: it requires valid backend credentials (CVSS PR:L), reachability of the store-management feature, and a separate privileged victim who opens the affected record (UI:A), which caps the realistic impact at low-confidentiality/low-integrity for the victim's session. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; severity is low (CVSS 4.0 base 4.8).