CVE-2024-4348

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, was found in osCommerce 4. Affected is an unknown function of the file /catalog/all-products. The manipulation of the argument cat leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-262488. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 30, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-434806.6Azure Service Fabric for Linux Remote Code Execution Vulnerability CVE-2024-434818.8Power BI Report Server Spoofing Vulnerability CVE-2024-434826.5Microsoft Outlook for iOS Information Disclosure Vulnerability CVE-2024-434837.5.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability CVE-2024-434847.5.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability CVE-2024-434857.5.NET and Visual Studio Denial of Service Vulnerability CVE-2024-434876.5Windows Mark of the Web Security Feature Bypass Vulnerability CVE-2024-434889.8Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remot CVE-2024-434898.8Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability CVE-2024-43497.3A vulnerability has been found in SourceCodester Pisay Online E-Learning System 1.0 and classified as critical. Affected by this vulnerabili CVE-2024-434919.8Microsoft is aware of a vulnerability in Servicing Stack that has rolled back the fixes for some vulnerabilities affecting Optional Componen CVE-2024-434927.8Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability