PT-2026-5414 · Unknown · Sellacious Ecommerce

Gurbanli · Published 2026-01-30 · Updated 2026-01-30 · CVE-2020-37003

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sellacious eCommerce version 4.6

Description Sellacious eCommerce 4.6 contains a persistent cross-site scripting issue in the Manage Your Addresses module. This allows attackers to inject malicious scripts into multiple address input fields, including full name, company, and address. Successful exploitation can lead to the execution of persistent script code, potentially enabling attackers to hijack user sessions and manipulate application modules.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-37003

Affected Products

Sellacious Ecommerce

References · 7

• 🔥 https://exploit-db.com/exploits/48467 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-37003 · Security Note
• https://sellacious.com/free-open-source-ecommerce-software · Note
• https://vulnerability-lab.com/get_content.php?id=2226 · Note
• https://sellacious.com · Note
• https://t.me/CVEtracker/43301 · Telegram Post
• https://vulncheck.com/advisories/sellacious-ecommerce-persistent-cross-site-scripting · Note