PT-2024-24174 · Unknown · Cosmetics/Beauty Product Online Store

Mohitkumar0786 · Published 2024-04-15 · Updated 2025-04-10 · CVE-2024-31649

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cosmetics and Beauty Product Online Store version 1.0

Description A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter. This enables attackers to potentially manipulate the website's behavior or steal user data.

Recommendations For Cosmetics and Beauty Product Online Store version 1.0, consider disabling the Product Name parameter until a patch is available to prevent exploitation. Restrict access to the affected parameter to minimize the risk of arbitrary script execution.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-31649

Affected Products

Cosmetics/Beauty Product Online Store

References · 8

• 🔥 https://github.com/Mohitkumar0786/CVE/blob/main/CVE-2024-31649.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-31649 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31649 · Security Note
• https://t.me/cvenotify/76872 · Telegram Post
• https://twitter.com/CVEnew/status/1779976091597475865 · Twitter Post
• https://t.me/cvenotify/76940 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1780006219903586460 · Twitter Post
• https://t.me/cvenotify/118624 · Telegram Post