High severity7.5NVD Advisory· Published Dec 11, 2025· Updated Apr 15, 2026

CVE-2024-58304

Description

SPA-CART CMS 1.9.0.3 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticated administrators to inject malicious scripts. Attackers can submit JavaScript payloads through the 'descr' parameter in the product edit form to execute arbitrary code in administrative users' browsers.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Spa Cart/SPA-CART CMSllm-create
Range: = 1.9.0.3

Patches

Vulnerability mechanics

References

www.exploit-db.com/exploits/51919nvd
www.vulncheck.com/advisories/spa-cart-cms-stored-cross-site-scripting-via-product-descriptionnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000