PyPI package
shuup
pkg:pypi/shuup
Vulnerabilities (2)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-25963 | Med | 6.1 | >= 1.6.0, < 2.11.0 | 2.11.0 | Sep 30, 2021 | In Shuup, versions 1.6.0 through 2.10.8 are vulnerable to reflected Cross-Site Scripting (XSS) that allows execution of arbitrary javascript code on a victim browser. This vulnerability exists due to the error page contents not escaped. | |
| CVE-2021-25962 | Hig | 8.0 | >= 0.4.2, < 2.11.0 | 2.11.0 | Sep 29, 2021 | “Shuup” application in versions 0.4.2 to 2.10.8 is affected by the “Formula Injection” vulnerability. A customer can inject payloads in the name input field in the billing address while buying a product. When a store administrator accesses the reports page to export the data as a |
- affected >= 1.6.0, < 2.11.0fixed 2.11.0
In Shuup, versions 1.6.0 through 2.10.8 are vulnerable to reflected Cross-Site Scripting (XSS) that allows execution of arbitrary javascript code on a victim browser. This vulnerability exists due to the error page contents not escaped.
- affected >= 0.4.2, < 2.11.0fixed 2.11.0
“Shuup” application in versions 0.4.2 to 2.10.8 is affected by the “Formula Injection” vulnerability. A customer can inject payloads in the name input field in the billing address while buying a product. When a store administrator accesses the reports page to export the data as a