CVE-2022-35493

MEDIUMNuclei

eShop 3.0.4 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2022-35493 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

A Cross-site scripting (XSS) vulnerability in json search parse and the json response in wrteam.in, eShop - Multipurpose Ecommerce Store Website version 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the get_products?search parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 8, 2026 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryMEDIUMeShop 3.0.4 - Cross-Site ScriptingCVSS 6.1

eShop 3.0.4 contains a reflected cross-site scripting vulnerability in json search parse and json response in wrteam.in.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the website.

Remediation

To remediate this issue, the application should implement proper input validation and sanitization techniques to prevent the execution of malicious scripts.

WeaknessesCWE-79
Authorsarafatansari
Template tagscvecve2022eshopxsswrteamvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:wrteam:eshop_-_ecommerce_\/_store_website:*:*:*:*:*:*:*:*
Shodan: http.html:"eShop - Multipurpose Ecommerce"
Shodan: http.html:"eshop - multipurpose ecommerce"
FOFA: body="eshop - multipurpose ecommerce"
https://github.com/Keyvanhardani/Exploit-eShop-Multipurpose-Ecommerce-Store-Website-3.0.4-Cross-Site-Scripting-XSS/blob/main/README.md https://nvd.nist.gov/vuln/detail/CVE-2022-35493 https://github.com/ARPSyndicate/kenzer-templates https://github.com/Keyvanhardani/Exploit-eShop-Multipurpose-Ecommerce-Store-Website-3.0.4-Cross-Site-Scripting-XSS

Source: ProjectDiscovery

References

2