Oro Inc OroCommerce 5.1.0
Approved changes feed: RSS · Atom
cpe:2.3:a:oroinc:orocommerce:5.1.0:-:*:*:*:*:*:*
part: a version: 5.1.0 update: -
| Vendor | Oroinc (cecfbc26-91c1-5ac6-b9e0-e44c0304077b) |
|---|---|
| Product | Orocommerce (bc2f0e23-3619-5d06-99a3-4499ab08b263) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/oroinc/orocommerce |
purl2cpe | 2026-06-01 10:13:24.880445 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-50677 |
vulnerable | 2026-06-08 06:52:11.384823 |
Details available
A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter.
Published: 2024-12-06T00:00:00.000Z
Updated: 2024-12-06T16:44:57.615Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-35950 |
vulnerable | 2026-06-08 05:46:06.044065 |
OroCommerce Cross-site Scripting vulnerability in add note dialog of Shopping List line item
MEDIUM (6.9)
OroCommerce is an open-source Business to Business Commerce application. In versions 4.1.0 through 4.1.13, 4.2.0 through 4.2.10, 5.0.0 prior to 5.0.11, and 5.1.0 prior to 5.1.1, the JS payload added to the product name may be executed at the storefront when adding a note to the shopping list line item containing a vulnerable product. An attacker should be able to edit a product in the admin area and force a user to add this product to Shopping List and click add a note for it. Versions 5.0.11 and 5.1.1 contain a fix for this issue.
Published: 2023-10-09T13:06:50.254Z
Updated: 2024-09-19T13:58:00.467Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.