CVE-2022-4600

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability was found in Shoplazza LifeStyle 1.1. It has been classified as problematic. This affects an unknown part of the file /admin/api/theme-edit/ of the component Product Carousel Handler. The manipulation of the argument Heading/Description leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-216195.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-707 CWE-79

Affected software

Vendor	Product	Versions
Shoplazza	LifeStyle	1.1

References

https://seclists.org/fulldisclosure/2022/Dec/11Mailing List, Third Party Advisory
https://seclists.org/fulldisclosure/2022/Dec/att-11/proof-of-concept-shoplazza.txtMailing List, Third Party Advisory
https://vuldb.com/?id.216195Third Party Advisory
https://seclists.org/fulldisclosure/2022/Dec/11Mailing List, Third Party Advisory
https://seclists.org/fulldisclosure/2022/Dec/att-11/proof-of-concept-shoplazza.txtMailing List, Third Party Advisory
https://vuldb.com/?id.216195Third Party Advisory

Timeline

Published: Dec 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-46015.4A vulnerability was found in Shoplazza LifeStyle 1.1. It has been declared as problematic. This vulnerability affects unknown code of the fi CVE-2022-46025.4A vulnerability was found in Shoplazza LifeStyle 1.1. It has been rated as problematic. This issue affects some unknown processing of the fi CVE-2022-460209.8WBCE CMS v1.5.4 can implement getshell by modifying the upload file type.CVE-2022-460217.5X-Man 1.0 has a SQL injection vulnerability, which can cause data leakage.CVE-2022-460259.1Totolink N200RE_V5 V9.3.5u.6255_B20211224 is vulnerable to Incorrect Access Control. The device allows remote attackers to obtain Wi-Fi syst CVE-2022-46036.5A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the compo CVE-2022-46048.8A vulnerability classified as problematic was found in wp-english-wp-admin Plugin up to 1.5.1. Affected by this vulnerability is the functio CVE-2022-460474.9AeroCMS v0.0.1 is vulnerable to SQL Injection via the delete parameter.CVE-2022-46055.4Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2022-460517.2The approve parameter from the AeroCMS-v0.0.1 CMS system is vulnerable to SQL injection attacks.CVE-2022-460584.8AeroCMS v0.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers to CVE-2022-460596.5AeroCMS v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).