PT-2025-18088 · Unknown · Thecartpress

Published 2025-04-28 · Updated 2025-04-30 · CVE-2015-4582

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TheCartPress boot-store versions 1.6.4

Description The issue allows for XSS in the header.php file through the tcp register error function. It is noted that this issue is not related to any Oracle product.

Recommendations For version 1.6.4, consider disabling the tcp register error function in the header.php file as a temporary workaround until a patch is available. Restrict access to the header.php file to minimize the risk of exploitation. Avoid using the tcp register error function until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-4582

Affected Products

Thecartpress

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2015-4582 · Security Note
• https://themes.trac.wordpress.org/browser/boot-store/1.6.4/header.php#L348 · Note
• https://t.me/cvetracker/22536 · Telegram Post
• https://t.me/cvenotify/120056 · Telegram Post
• https://t.me/cvenotify/120378 · Telegram Post
• https://t.me/cvedetector/23928 · Telegram Post