CVE-2020-29070

Name of the Vulnerable Software and Affected Versions osCommerce version 2.3.4.1

Description The issue allows an authenticated user to enter an XSS payload into the title section of newsletters, potentially leading to a cross-site scripting vulnerability.

Recommendations For osCommerce version 2.3.4.1, consider restricting access to the newsletter title section for authenticated users until a fix is available. As a temporary workaround, validate and sanitize all user input in the title section to prevent XSS payload execution.