--- title: "CX-2021-4815" date: "2022-04-25T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cx-2021-4815/" --- # CX-2021-4815 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) CVE-2021-43432 **Published:** Apr 25, 2022 6.1 Medium Severity XMALL XSS OR Ori Ron Reported by Checkmarx Zero Details Overview ## Summary XSS exists in the XMALL admin panel via the GET parameter in product-add.jsp Currently there is no fixed version. ## Product XMALL is vulnerable since Oct 21, 2017. ## Impact Executing scripts on behalf of the admin ## Steps to reproduce 1. Run [XMALL](https://github.com/Exrick/xmall) with all its dependencies 2. Navigate to **HOSTNAME** : \_\_PORT\_NUMBER\_\_ /product-add?detail=%3Cscript%3Ealert(%27test%27);%3C/script%3E ### Expected result: 1. alert will be popped with “test” ## Remediation No fixed version ## Credit The issue was discovered, validated, and disclosed by [Meir Benayoun](https://www.linkedin.com/in/meirbenayoun/) and [Ori Ron](https://www.linkedin.com/in/ori-ron-40099912b/) ## Resources 1. [Relevant Issue on GitHub](https://github.com/Exrick/xmall/issues/63) 2. [The Commit with the vulnerability](https://github.com/Exrick/xmall/commit/c673593ec00cb44d9ecf4c4e72d560ed01ec771a#diff-568e1bd15b5b477644c7d1d8ed533a9330643b9294342ccceb7ce19f215c5282) 3. [User input is naively embedded in `htmlData`](https://github.com/Exrick/xmall/blob/b146cceb21ca42d4237f31dbd7af5ced49048a56/xmall-manager-web/src/main/webapp/WEB-INF/jsp/product-add.jsp#L4) 4. [User input is rendered](https://github.com/Exrick/xmall/blob/b146cceb21ca42d4237f31dbd7af5ced49048a56/xmall-manager-web/src/main/webapp/WEB-INF/jsp/product-add.jsp#L38) 0 Medium Severity CVSS v3.1 Score 6.1 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None Advisory Timeline1. Disclosed Jul 27, 2021 First disclosure, no response from the developer 2. Disclosed Aug 29, 2021 Another notice without a response 3. Disclosed Jan 9, 2022 Issue was opened on the GitHub Issues page, developer has no plans to fix the vulnerability ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)