CVE-2024-58304

MEDIUM

SPA-CART CMS 1.9.0.3 Stored Cross-Site Scripting

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-58304 has a selected CVSS score of 5.3 (medium); EIP currently links 1 catalogued exploit.

Description

SPA-CART CMS 1.9.0.3 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticated administrators to inject malicious scripts. Attackers can submit JavaScript payloads through the 'descr' parameter in the product edit form to execute arbitrary code in administrative users' browsers.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 18, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

SPA-CART CMS

Browse SPA-Cart / SPA-CART CMS

Default status: unaffected

CVE List1.9.0.3affected

Proofs of concept

1

Catalogued exploits

ExploitDBSPA-CART CMS - Stored XSSExploitDB exploitby Eren SenNot analyzed1 file
ExploitDB
PoC details

References

4