CVE-2024-58304

HIGH

SPA-CART CMS 1.9.0.3 - XSS

Title source: llm

Description

SPA-CART CMS 1.9.0.3 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticated administrators to inject malicious scripts. Attackers can submit JavaScript payloads through the 'descr' parameter in the product edit form to execute arbitrary code in administrative users' browsers.

Exploits (1)

exploitdb WORKING POC

by Eren Sen · textwebappsphp

https://www.exploit-db.com/exploits/51919

View Code ZIP pw:eip

References (2)

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/51919

[Third Party Advisory] https://www.vulncheck.com/advisories/spa-cart-cms-stored-cross-site-scripting-via-product-description

Scores

CVSS v3 7.5

EPSS 0.0003

EPSS Percentile 8.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-79

Status published

Products (1)

SPA-Cart/SPA-CART CMS 1.9.0.3

Published Dec 11, 2025

Tracked Since Feb 18, 2026