{"id":"GHSA-wgvv-5396-ggvj","aliases":["CVE-2011-0451"],"title":"EC-CUBE XSS Vulnerabilities","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"Multiple cross-site scripting (XSS) vulnerabilities in (1) `data/Smarty/templates/default/list.tpl` and (2) `data/Smarty/templates/default/campaign/bloc/cart_tag.tpl` in EC-CUBE before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.","severity":"medium","score":null,"published":"2022-05-17T02:02:18.000Z","modified":"2024-01-15T21:26:53.850Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"ec-cube/ec-cube","sources":[{"name":"OSV · GHSA-wgvv-5396-ggvj","url":"https://osv.dev/vulnerability/GHSA-wgvv-5396-ggvj"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.4.4"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["2.4.4"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2011-0451","https://github.com/EC-CUBE/ec-cube/commit/8ef6541fc66b86d40a4333ec1608be3191c5e463","https://exchange.xforce.ibmcloud.com/vulnerabilities/65079","https://github.com/EC-CUBE/ec-cube","https://web.archive.org/web/20200229005109/http://www.securityfocus.com/bid/46100","http://jvn.jp/en/jp/JVN84393059/index.html","http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000011.html","http://svn.ec-cube.net/open_trac/changeset/18742","http://www.ec-cube.net/info/weakness/weakness.php?id=36"],"sources":[{"name":"OSV","id":"GHSA-wgvv-5396-ggvj","modified":"2024-01-15T21:26:53.850575Z","url":"https://osv.dev/vulnerability/GHSA-wgvv-5396-ggvj"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T09:20:32.087Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}