Medium severity6.1NVD Advisory· Published Dec 11, 2025· Updated Sep 28, 2026

CVE-2024-58304

Description

SPA-CART CMS before 2.0.0 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticated administrators to inject malicious scripts. Attackers can submit JavaScript payloads through the 'descr' parameter in the product edit form to execute arbitrary code in administrative users' browsers.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Spa Cart/Spa Cartcmsllm-fuzzy
Range: =1.9.0.3

Patches

Vulnerability mechanics

References

github.com/olegkhorev/php-spa-cart/releases/tag/v2.0.0nvd
www.exploit-db.com/exploits/51919nvd
www.vulncheck.com/advisories/spa-cart-cms-stored-cross-site-scripting-via-product-descriptionnvd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000