TI-2025-29819 CVE-2025-47289
Stored XSS in CE Phoenix Cart Testimonials Allows Account Takeover if Missing HttpOnly Flag
Priority HIGH 72
CE Phoenix is a free, open-source eCommerce platform.
PhoenixCart
Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
PhoenixCart records in CISA KEVNo PhoenixCart vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
3 records
TI-2024-16732 CVE-2024-25415 · GHSA-pq2x-v8q9-52vx
A remote code execution (RCE) vulnerability in /admin/define_language.php of CE Phoenix…
Priority HIGH 67
A remote code execution (RCE) vulnerability in /admin/define_language.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP code via injecting a crafted payload into the file english.php.
TI-2024-38393 CVE-2024-58296 · GHSA-4rv9-842w-4464
CE Phoenix v1.0.8.20 Stored Cross-Site Scripting via admin/currencies.php
Priority MEDIUM 57
CE Phoenix v1.0.8.20 contains a stored cross-site scripting vulnerability in the currencies administration panel that allows attackers to inject malicious scripts.