CVE-2021-33562

MEDIUM

Shopizer <2.17.0 - XSS

Title source: llm

Description

A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via the ref parameter to a page about an arbitrary product, e.g., a product/insert-product-name-here.html/ref= URL.

Exploits (1)

exploitdb WORKING POC

by Marek Toth · textwebappsjava

https://www.exploit-db.com/exploits/49901

View Code ZIP pw:eip

References (3)

[Patch, Third Party Advisory] https://github.com/shopizer-ecommerce/shopizer/commit/197f8c78c8f673b957e41ca2c823afc654c19271

[Patch, Third Party Advisory] https://github.com/shopizer-ecommerce/shopizer/compare/2.16.0...2.17.0

[Exploit, Third Party Advisory, VDB Entry] https://www.exploit-db.com/exploits/49901

Scores

CVSS v3 4.8

EPSS 0.0032

EPSS Percentile 55.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (2)

com.shopizer/shopizer 0 - 2.17.0Maven

shopizer/shopizer < 2.17.0

Published May 24, 2021

Tracked Since Feb 18, 2026