PT-2025-50750

CVE-2024-58296

Published

2025-12-11

Updated

2026-10-02

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions CE Phoenix version 3.0.1

Description CE Phoenix version 3.0.1 has a stored cross-site scripting issue within the currencies administration panel. An attacker can inject malicious scripts by inserting XSS payloads into the title field. When administrators view the currencies page, the injected JavaScript will execute. The vulnerability allows for the execution of arbitrary JavaScript.

Recommendations Apply a fix to sanitize the title field in the currencies administration panel to prevent the injection of malicious scripts.

Exploitability

Exploit

Fix

Impacts

Researchers

Tmrswrr

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers