CVE-2022-35493

MediumCVSS 6.1

Published: 08/08/2022(UTC)Updated: 08/07/2026(UTC)Translated: 09/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.42%

70th percentile - higher than 70% of all known CVEs

Summary

A Cross-site scripting (XSS) vulnerability in the JSON search parse and response in eShop - Multipurpose Ecommerce Store Website version 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the get_products?search parameter.

Risk Assessment

The risk for the organization includes session hijacking, account takeover, and leakage of sensitive data, potentially leading to loss of customer trust and reputational damage.

Recommendation

Immediately update to the latest software version and implement input validation and encoding for the search parameter.

Original NVD description (English source)

A Cross-site scripting (XSS) vulnerability in json search parse and the json response in wrteam.in, eShop - Multipurpose Ecommerce Store Website version 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the get_products?search parameter.