---
title: "CVE-2023-46499"
date: "2023-04-27T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cve-2023-46499/"
---

# CVE-2023-46499

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

Fixed: Apr 27, 2023

CVE-2023-46499  **Published:** Apr 27, 2023

9.3 Critical Severity js npm stored XSS

MT Mário Teixeira  Reported by Checkmarx Zero

Details Overview

## Summary

NPM’s package `@evershop/evershop` prior to 1.0.0-rc.5 contains a Stored Cross-Site Scripting (XSS) vulnerability affecting various functionalities of the Admin Panel. Attackers can particularly inject malicious code during the creation of new products. The registration of users is also affected, which means that an unauthenticated user could store malicious code during registration which will affect administrators that visit the users’ section. The latter could lead to more serious attack vectors, including account takeover.

## Product

This vulnerability affects NPM’s package `@evershop/evershop` in versions prior to 1.0.0-rc.5.

## Impact

This issue enables an attacker to store malicious code permanently on the database, which can lead to various issues.

## Steps to reproduce

1. Install the `@evershop/evershop` package dependency for any version prior to 1.0.0-rc.5
2. Run the EverShop Web Application on localhost
3. Navigate to registering a new user
4. In the “Full Name” field type:

    ```js
    </script><script>alert('XSS')</script>
    ```
5. Save the form

### Expected result:

As soon as an administrator visits the “Customers” tab, the malicious code is executed and an alert will appear.

## Remediation

A fix was released in commit [0b5cb6e](https://github.com/evershopcommerce/evershop/commit/0b5cb6e5511194a6f3e28c6c481b54dafd2d5a7d), where input validation was implemented to protect against XSS. Users are recommended to upgrade to version 1.0.0-rc.5, which includes this fix.

## Credit

This issue was discovered and reported by Checkmarx SCA Security Analyst [Mário Teixeira](https://www.linkedin.com/in/marioleitao-teixeira/).

## Resources

1. [Pull Request](https://github.com/evershopcommerce/evershop/pull/244)
2. [Commit](https://github.com/evershopcommerce/evershop/commit/0b5cb6e5511194a6f3e28c6c481b54dafd2d5a7d)

0  Critical Severity CVSS v3.1 Score

   9.3

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None

Advisory Timeline1. Discovered Mar 17, 2023
2. Disclosed May 18, 2023 The vulnerability was privately disclosed to the maintainer
3. Fixed Apr 27, 2023 A fix commit was released with the vulnerability fix.

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)