CVE-2024-58296
CE Phoenix v1.0.8.20 Stored Cross-Site Scripting via admin/currencies.php
- State
- Published
- Severity
- 5.3 Medium
- Published
- Dec 11, 2025
- Updated
- Oct 29, 2026
- Reserved
- Dec 11, 2025
Description
CE Phoenix v1.0.8.20 contains a stored cross-site scripting vulnerability in the currencies administration panel that allows attackers to inject malicious scripts. Attackers can insert XSS payloads in the title field to execute arbitrary JavaScript when administrators view the currencies page.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
CE PhoenixPhoenixCart |
|
References
- ExploitDB-52015exploit
- PhoenixCart Homepageproduct
- CE Phoenix Admin Panel Demoexploitmedia-coverage
- SoftAculous CE Phoenix App Pageproduct
- https://www.vulncheck.com/advisories/ce-phoenix-v-stored-cross-site-scripting-via-currencies-administrationthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.