Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2022-35493

Quick assessment

Affected
n/a n/a
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WRTeam eShop是印度WRTeam公司的一个电子商务网站。 WRTeam eShop 3.0.4版本存在安全漏洞，该漏洞源于攻击者利用json搜索解析和json响应的跨站脚本漏洞通过get_products?search参数注入任意web脚本或利用HTML。

AI Predicted 6.1 Difficulty: Easy EPSS 1.85% · P78

Public Exploits 1

Nuclei · 1 CVE-2022-35493.yaml [template]

Possible ATT&CK Techniques 1 AI

T1059.007 · JavaScript

Affected Version Matrix 1

VendorProduct Version RangeStatus
n/a n/a n/a affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-35493

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A Cross-site scripting (XSS) vulnerability in json search parse and the json response in wrteam.in, eShop - Multipurpose Ecommerce Store Website version 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the get_products?search parameter.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WRTeam eShop 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WRTeam eShop是印度WRTeam公司的一个电子商务网站。 WRTeam eShop 3.0.4版本存在安全漏洞，该漏洞源于攻击者利用json搜索解析和json响应的跨站脚本漏洞通过get_products?search参数注入任意web脚本或利用HTML。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- n/a n/a -

II. Public POCs for CVE-2022-35493

# POC Description Source Link Shenlong Link
1 eShop 3.0.4 contains a reflected cross-site scripting vulnerability in json search parse and json response in wrteam.in. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35493.yaml POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-35493

请登录查看更多情报信息。

Other References for CVE-2022-35493 (1)

Same Patch Batch · n/a · 2022-08-08 · 11 CVEs total

CVE-2022-35487 Zammad 安全漏洞
CVE-2022-35488 Zammad 资源管理错误漏洞
CVE-2022-35489 Zammad 安全漏洞
CVE-2022-35490 Zammad 安全漏洞
CVE-2022-36267 Airspan AirSpot 5410 安全漏洞
CVE-2022-36266 Airspan AirSpot 5410 跨站脚本漏洞
CVE-2022-36265 Airspan AirSpot 5410 安全漏洞
CVE-2022-36264 Airspan AirSpot 5410 代码问题漏洞
CVE-2022-34293 Wolfssl 安全漏洞
CVE-2021-41615 Embedthis Software GoAhead 安全特征问题漏洞

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2022-35493

No comments yet

Leave a comment