PT-2026-31729

CVE-2023-54362

Published

2026-04-09

Updated

2026-09-26

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Joomla VirtueMart Shopping-Cart version 4.0.12

Description A reflected cross-site scripting issue exists that allows attackers to inject malicious scripts by manipulating the keyword parameter. Attackers can craft malicious URLs containing script payloads in the keyword parameter of the product-variants endpoint to execute arbitrary JavaScript in victim browsers and potentially steal session tokens or credentials.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Fix

Impacts

Researchers

Cracker

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers