Disclosed vulnerabilities
CVE-2021-43432 Published: Apr 25, 2022

XSS in XMALL ecommerce system

6.1 Medium Severity XMALL XSS
Ori Ron Reported by Checkmarx Zero

Summary

XSS exists in the XMALL admin panel via the GET parameter in product-add.jsp
Currently there is no fixed version.

Product

XMALL is vulnerable since Oct 21, 2017.

Impact

Executing scripts on behalf of the admin

Steps to reproduce

  1. Run XMALL with all its dependencies
  2. Navigate to HOSTNAME : __PORT_NUMBER__ /product-add?detail=%3Cscript%3Ealert(%27test%27);%3C/script%3E

Expected result:

  1. alert will be popped with “test”

Remediation

No fixed version

Credit

The issue was discovered, validated, and disclosed by Meir Benayoun and Ori Ron

Resources

  1. Relevant Issue on GitHub
  2. The Commit with the vulnerability
  3. User input is naively embedded in `htmlData`
  4. User input is rendered

Explore more findings

27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page 17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page 17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page 12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page 14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page 14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page 14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite_ip` Field 7.5 Visit the page 14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page 14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page 14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page 14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page

Stay connected and never miss a research update!

Contact us