PT-2026-55709 · Kirilkirkov · Ecommerce-Codeigniter-Bootstrap

Leousum · Publicado 2026-07-04 · Atualizado 2026-07-04 · CVE-2026-14633

Positive Technologies (AI Summary) · Pt

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Nome do Software Vulnerável e Versões Afetadas kirilkirkov Ecommerce-CodeIgniter-Bootstrap versões anteriores a 49b20f53de2b7ec34e920b11c863f1491d911a04

Descrição Um problema de cross site scripting existe no componente Hidden REST API Endpoint. Um invasor remoto pode explorar isso manipulando os argumentos title ou description no endpoint '/index.php/api/product/set'.

Recomendações Implantar o patch d9785f995da77bdc62fb2d34bad5f7a162c9ad23.

Exploit

Correção

Code Injection

XSS

Enumeração de Fraquezas

CWE-94

CWE-79

Identificadores relacionados

CVE-2026-14633

Produtos afetados

Ecommerce-Codeigniter-Bootstrap

Referências · 10

• 🔥 https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/security/advisories/GHSA-8q62-q8qx-j49g · Exploit
• https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/d9785f995da77bdc62fb2d34bad5f7a162c9ad23 · Correção
• https://vuldb.com/vuln/376148 · Nota
• https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap · Nota
• https://vuldb.com/vuln/376148/cti · Nota
• https://vuldb.com/submit/845903 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-14633 · Nota de Segurança
• https://twitter.com/CVEnew/status/2073447432826876043 · Publicação no Twitter
• https://twitter.com/infoflowcloud/status/2073448139281883420 · Publicação no Twitter
• https://vuldb.com/cve/CVE-2026-14633 · Nota