Hishamco

**Name of the Vulnerable Software and Affected Versions** SimplCommerce versions prior to commit 6142d3b5 **Description** Stored cross-site scripting (XSS) exists in the 'NewsItemApiController' endpoint. An authenticated administrator can execute arbitrary JavaScript through the `ShortContent` and `FullContent` fields. This occurs because the input is stored without HTML sanitization and is subsequently rendered unencoded using the `@Html.Raw()` function. **Recommendations** Update SimplCommerce to commit 6142d3b5 or a later version. As a temporary mitigation, restrict administrative access to the news item management features.

**Name of the Vulnerable Software and Affected Versions** SimplCommerce versions prior to commit 6233d73e **Description** Cross-site request forgery (CSRF) occurs in the NewsItemApiController. This issue allows an unauthenticated remote attacker to create or modify news items with administrator privileges by submitting a crafted form to the '/api/news-items' endpoint. The flaw is caused by a lack of anti-CSRF protection, which is a mechanism used to prevent unauthorized commands from being transmitted from a user that the web application trusts. **Recommendations** Update to the version containing commit 6233d73e or later.