CVE-2026-84438— OpenCart Autocomplete Workflow edit.php cross site scripting
Quick assessment
Affected
n/a OpenCart
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 OpenCart 4.1.0.3/4.1.0.4 中发现了一个漏洞。该漏洞影响了组件“Autocomplete Workflow”中文件 的一个未知功能。通过操纵 参数可触发跨站脚本（XSS）攻击。该攻击可远程发起。此漏洞的利用方式已公开披露，可能被实际利用。厂商此前已被通知此事，但未以任何方式做出回应。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84438
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenCart Autocomplete Workflow edit.php cross site scripting
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | OpenCart | 4.1.0.3 |
cpe:2.3:a:opencart:opencart:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-84438
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84438
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-84438 (1)
-
🔗 CVE-2026-84438 OpenCart Autocomplete Workflow edit.php cross site scripting Read full article vdb-entry technical-description
Other References for CVE-2026-84438 (4)
-
https://vuldb.com/cve/CVE-2026-84438 third-party-advisory
-
-
https://vuldb.com/submit/885225 third-party-advisory
Same Patch Batch · n/a · 2026-09-02 · 3 CVEs total
| CVE-2026-84430 | 6.3 MEDIUM | gouguoa edit_personal Endpoint Index.php update dynamically-determined object attributes |
| CVE-2026-84437 | 3.5 LOW | OpenCart Autocomplete Workflow address.php cross site scripting |
IV. Related Vulnerabilities
Same product: OpenCart
-
CVE-2026-84437
OpenCart Autocomplete Workflow address.php cross site script -
CVE-2026-18412
The OpenCart v4.2.0.0 extension installer contains a directo -
CVE-2021-47953
OpenCart 3.0.3.7 Cross-Site Request Forgery via account/pass -
CVE-2021-47946
OpenCart 3.0.3.6 Account Takeover via Cross Site Request For -
CVE-2021-47923
OpenCart 3.0.3.8 Session Fixation via OCSESSID Cookie
Same vendor: n/a
-
CVE-2026-84437
OpenCart Autocomplete Workflow address.php cross site script -
CVE-2026-84430
gouguoa edit_personal Endpoint Index.php update dynamically- -
CVE-2026-84423
Casdoor upload-resource API resource.go missing authenticati -
CVE-2026-51742
TOTOLINK T6 4.1.5 访问控制不当漏洞 -
CVE-2026-51745
TOTOLINK T6 4.1.5 MQTT 未认证访问控制漏洞
Same weakness: CWE-79
-
CVE-2026-84437
OpenCart Autocomplete Workflow address.php cross site script -
CVE-2026-84701
NocoBase Rich Text Field Stored Cross-Site Scripting via API -
CVE-2026-84695
BookStack before 26.05.4 Stored XSS via Drawing Upload -
CVE-2026-84477
AVideo Stored XSS via Live Schedule Title Description -
CVE-2026-84371
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-polic
V. Comments for CVE-2026-84438
No comments yet