Bdtask Isshue vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Bdtask Isshue: 4 record(s), with affected versions and fixes.cpe:2.3:a:bdtask:isshue
CVE-2025-40679
Medium · 5.1
CWE-79 Jan 20, 2026
HTML injection in Isshue from Bdtask
HTML
Injection vulnerability in Isshue by Bdtask, consisting os an HTML injection due to a lack os proper validation of user input by sending a POST request to '/category_product_search', affecting the 'product_name' parameter.
CVE-2021-47769
Medium · 4.8
CWE-79 Jan 15, 2026
Isshue Shopping Cart 3.5 - 'Title' Cross Site Scripting (XSS)
Isshue Shopping Cart 3.5 contains a persistent cross-site scripting vulnerability in title input fields across stock, customer, and invoice modules. Attackers with privileged user accounts can inject malicious scripts that execute on preview, potentially enabling session hijacking and persistent phishing attacks.
CVE-2025-13239
High · 7.5
CWE-840 Nov 16, 2025
Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution submit_checkout behavioral workflow
A security vulnerability has been detected in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution 5. Affected by this issue is some unknown functionality of the file /submit_checkout. Such manipulation of the argument order_total_amount/cart_total_amount leads to enforcement of behavioral workflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-13186
Medium · 5.4
CWE-79 Nov 14, 2025
Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution manage_customer cross site scripting
A weakness has been identified in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution up to 4.0. This impacts an unknown function of the file /dashboard/Ccustomer/manage_customer. This manipulation of the argument Search causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.