PT-2026-4513 · Unknown · Peel Shopping

Published 2026-01-23 · Updated 2026-01-24 · CVE-2021-47897

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PEEL Shopping version 9.3.0

Description The software contains a stored cross-site scripting issue in the address parameter of the ''change params.php'' script. Attackers can inject malicious JavaScript payloads that execute when users interact with the address text box, potentially enabling client-side script execution. The vulnerable parameter is address.

Recommendations Apply updates to address the issue in the ''change params.php'' script. As a temporary workaround, sanitize user input for the address parameter to prevent the injection of malicious scripts.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-47897

Affected Products

Peel Shopping

References · 6

• 🔥 https://exploit-db.com/exploits/49553 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47897 · Security Note
• https://twitter.com/CVEnew/status/2014995834010759275 · Twitter Post
• https://t.me/CVEtracker/42861 · Telegram Post
• https://vulncheck.com/advisories/peel-shopping-address-stored-cross-site-scripting · Note
• https://web.archive.org/web/20210302174407/https://peel.fr · Note