CVE-2023-54349
AmazCart CMS 3.4 Reflected Cross-Site Scripting via Search
- State
- Published
- Severity
- 5.1 Medium
- Published
- May 5, 2026
- Updated
- May 24, 2026
- Reserved
- Jan 10, 2026
Description
AmazCart CMS 3.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the search functionality. Attackers can enter script tags in the search box to execute arbitrary JavaScript that fires when search history is viewed or results are displayed.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 6.1 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
AmazCart CMSSpondonit |
|
References
- ExploitDB-51219exploit
- Official Product Homepageproduct
- Product Referenceproduct
- VulnCheck Advisory: AmazCart CMS 3.4 Reflected Cross-Site Scripting via Searchthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.