CVE-2026-29175 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Stored XSS vulnerabilities exist in the Commerce Inventory page. The Product Title, Varia…
High CVSS: 8.6

CVE-2026-29175

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Stored XSS vulnerabilities exist in the Commerce Inventory page. The Product Title, Variant Title, and Variant SKU fields are rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript when any user (including administrators) views the inventory management page. This vulnerability is fixed in 5.5.3.
Vendor
Craftcms
Product
Craft Commerce
CWE
CWE-79
Yayın Tarihi
2026-03-10 20:16:38
Güncelleme
2026-03-11 16:56:41
Source Identifier
security-advisories@github.com
KEV Date Added
-

Kategoriler

CWE-79 Craft Commerce HIGH Craftcms 2026

Referanslar

https://github.com/craftcms/commerce/commit/9f0638a4fb29ed8295a463385a7cc49ec986e33a https://github.com/craftcms/commerce/security/advisories/GHSA-cfpv-rmpf-f624 https://github.com/craftcms/commerce/security/advisories/GHSA-cfpv-rmpf-f624