Simplcommerce vulnerabilities
Published CVEs affecting Simplcommerce products: 2 record(s), with severity, exploitation and fixes.
CVE-2026-9591
Medium · 6.9
CWE-352 Jun 17, 2026
Cross-Site Request Forgery (CSRF) in SimplCommerce News Module
Cross-site request forgery (CSRF) in NewsItemApiController in SimplCommerce prior to commit 6233d73e allows an unauthenticated remote attacker to create or modify news items as an administrator via a crafted form submitted to `/api/news-items`, due to missing anti-CSRF protection.
CVE-2026-11975
Medium · 6.2
CWE-79 Jun 17, 2026
Stored Cross-Site Scripting (XSS) in SimplCommerce News Module Admin Interface
Stored cross-site scripting (XSS) in NewsItemApiController In SimplCommerce prior to commit 6142d3b5 allows an authenticated administrator to execute arbitrary JavaScript via the ShortContent and FullContent fields, which are stored without HTML sanitization and rendered unencoded via @Html.Raw()