CVE-2024-21517

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the redirect parameter of customer account/login route. An attacker can inject arbitrary HTML and Javascript into the page response. As this vulnerability is present in the account functionality it could be used to target and attack customers of the OpenCart shop. **Notes:** 1) The fix for this vulnerability is incomplete

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 22, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-215187.2This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to im CVE-2024-215197.2This affects versions of the package opencart/opencart from 4.0.0.0. An Arbitrary File Creation issue was identified via the database restor CVE-2024-21529.8A vulnerability, which was classified as critical, has been found in SourceCodester Online Mobile Management Store 1.0. Affected by this iss CVE-2024-215206.1Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template f CVE-2024-215217.5All versions of the package @discordjs/opus are vulnerable to Denial of Service (DoS) due to providing an input object with a property toStr CVE-2024-215227.5All versions of the package audify are vulnerable to Improper Validation of Array Index when frameSize is provided to the new OpusDecoder().CVE-2024-215237.5All versions of the package images are vulnerable to Denial of Service (DoS) due to providing unexpected input types to several different fu CVE-2024-215249.1All versions of the package node-stringbuilder are vulnerable to Out-of-bounds Read due to incorrect memory length calculation, by calling T CVE-2024-215258.3All versions of the package node-twain are vulnerable to Improper Check or Handling of Exceptional Conditions due to the length of the sourc CVE-2024-215267.5All versions of the package speaker are vulnerable to Denial of Service (DoS) when providing unexpected input types to the channels property CVE-2024-215278.2Versions of the package github.com/gotenberg/gotenberg/v8/pkg/gotenberg before 8.1.0; versions of the package github.com/gotenberg/gotenberg CVE-2024-215285.9All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to impro