Read the docs
TI-2023-04193 Aliases CVE-2023-4547GHSA-rv8g-38vm-jx6h

SPA-Cart eCommerce CMS search cross site scripting

Priority MEDIUM 58CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting, Code execution
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79 and CWE-94.

Summary

A flaw has been found in SPA-Cart eCommerce CMS 1.9.0.3. The affected element is an unknown function of the file /search. This manipulation of the argument filter[brandid]/filter[price] causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 1.9.1.4 is sufficient to fix this issue. It is advisable to upgrade the affected component.

Why it matters now

EPSS 0.6034 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix Fixed eCommerce CMS (SPA-Cart): 1.9.1.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SPA-CarteCommerce CMS1.9.0.31.9.1.4Patch availableCNA
  • eCommerce CMS VendorSPA-Cart Affected 1.9.0.3 Fixed in 1.9.1.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:spa-cart:ecommerce_cms:1.9.0.3:*:*:*:*:*:*:*1.9.0.3VulnerableSPA-Cart
  • cpe:2.3:a:spa-cart:ecommerce_cms:1.9.0.3:*:*:*:*:*:*:* Versions 1.9.0.3 Vulnerable ·SPA-Cart

Remediation

  • Fix · CNA eCommerce CMS (SPA-Cart) Fixed in 1.9.1.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-4547
  2. 2026-10-03 Alias added: GHSA-rv8g-38vm-jx6h

References

Exploit 2

Patch 1

  • TI-2023-04194 SPA-Cart eCommerce CMS GET Parameter search sql injection CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences