CVE-2024-39090

CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources
Severity
6.1MEDIUM
EPSS
3.1%
top 13.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Phpgurukul Online Shopping Portal
Timeline
PublishedJul 18

Description

The PHPGurukul Online Shopping Portal Project version 2.0 contains a vulnerability that allows Cross-Site Request Forgery (CSRF) to lead to Stored Cross-Site Scripting (XSS). An attacker can exploit this vulnerability to execute arbitrary JavaScript code in the context of a user's session, potentially leading to account takeover.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-m924-v4rq-m8q5: The PHPGurukul Online Shopping Portal Project version 2↗2024-07-18
▶
CVEList
CVE-2024-39090: The PHPGurukul Online Shopping Portal Project version 2↗2024-07-18
▶
CVE-2024-39090 (MEDIUM CVSS 6.1) | The PHPGurukul Online Shopping Port | cvebase.io