CVE-2021-47769

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Isshue Shopping Cart 3.5 contains a persistent cross-site scripting vulnerability in title input fields across stock, customer, and invoice modules. Attackers with privileged user accounts can inject malicious scripts that execute on preview, potentially enabling session hijacking and persistent phishing attacks.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Bdtask	Isshue Shopping Cart	3.5

References

https://www.bdtask.com/multi-store-ecommerce-shopping-cart-software/Product
https://www.exploit-db.com/exploits/50490Exploit, Third Party Advisory
https://www.vulnerability-lab.com/get_content.php?id=2284Third Party Advisory
https://www.exploit-db.com/exploits/50490Exploit, Third Party Advisory
https://www.vulnerability-lab.com/get_content.php?id=2284Third Party Advisory

Timeline

Published: Jan 15, 2026
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-477708.8OpenPLC v3 contains an authenticated remote code execution vulnerability that allows attackers with valid credentials to inject malicious co CVE-2021-477715.5RDP Manager 4.9.9.3 contains a denial of service vulnerability in connection input fields that allows local attackers to crash the applicati CVE-2021-477729.810-Strike Network Inventory Explorer Pro 9.31 contains a buffer overflow vulnerability in the text file import functionality that allows rem CVE-2021-477737.8Dynojet Power Core 2.3.0 contains an unquoted service path vulnerability in the DJ.UpdateService that allows local authenticated users to po CVE-2021-477749.8Kingdia CD Extractor 3.0.2 contains a buffer overflow vulnerability in the registration name field that allows attackers to execute arbitrar CVE-2021-477758.4YouTube Video Grabber, now referred to as YouTube Downloader, 1.9.9.1 contains a buffer overflow vulnerability that allows attackers to exec CVE-2021-477765.3Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple CVE-2021-477778.2Build Smart ERP 21.0817 contains an unauthenticated SQL injection vulnerability in the 'eidValue' parameter of the login validation endpoint CVE-2021-477787.2GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator can inject arbitrary CVE-2021-477795.4Dolibarr ERP-CRM 14.0.2 contains a stored cross-site scripting vulnerability in the ticket creation module that allows low-privilege users t CVE-2021-477807.8Macro Expert 4.7 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated CVE-2021-477819.8Cmder Console Emulator 1.3.18 contains a buffer overflow vulnerability that allows attackers to trigger a denial of service condition throug