Simplcommerce
Approved changes feed: RSS · Atom
cpe:2.3:a:simplcommerce:simplcommerce:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Simplcommerce (3c9a0db3-9968-58c9-a862-5152e96884ce) |
|---|---|
| Product | Simplcommerce (6b8adba8-e060-5460-9d48-5c7206a37baa) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/simplcommerce/simplcommerce |
purl2cpe | 2026-06-01 10:15:01.862887 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-9591 |
vulnerable | 2026-07-29 01:09:07.203133 |
Cross-Site Request Forgery (CSRF) in SimplCommerce News Module
Cross-site request forgery (CSRF) in NewsItemApiController in SimplCommerce prior to commit 6233d73e allows an unauthenticated remote attacker to create or modify news items as an administrator via a crafted form submitted to `/api/news-items`, due to missing anti-CSRF protection.
Published: 2026-06-17T13:41:49.439Z
Updated: 2026-06-18T13:46:21.749Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-11975 |
vulnerable | 2026-07-29 00:23:31.843689 |
Stored Cross-Site Scripting (XSS) in SimplCommerce News Module Admin Interface
Stored cross-site scripting (XSS) in NewsItemApiController In SimplCommerce prior to commit 6142d3b5 allows an authenticated administrator to execute arbitrary JavaScript via the ShortContent and FullContent fields, which are stored without HTML sanitization and rendered unencoded via @Html.Raw()
Published: 2026-06-17T12:18:28.771Z
Updated: 2026-06-17T15:03:17.782Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.