CVE-2022-21149: Cross-site Scripting (XSS)

Severity: low (CVSS 3.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-05-01 · updated 2026-06-17
Weakness: CWE-79

Description

The package s-cart/s-cart before 6.9; the package s-cart/core before 6.9 are vulnerable to Cross-site Scripting (XSS) which can lead to cookie stealing of any victim that visits the affected URL so the attacker can gain unauthorized access to that user's account through the stolen cookie.

Affected products

s-cart/core: before 6.9.0 — fixed in 6.9.0

How to fix

Upgrade to a fixed version: s-cart/core 6.9.0. Check the vendor advisory for mitigations.

References

https://snyk.io/vuln/SNYK-PHP-SCARTCORE-2389036
https://snyk.io/vuln/SNYK-PHP-SCARTSCART-2389035
https://snyk.io/vuln/SNYK-PHP-SCARTCORE-2389036
https://snyk.io/vuln/SNYK-PHP-SCARTSCART-2389035

Get alerted when CVE-2022-21149 or the next vulnerability affects your stack