Vulnerabilidades de Simplcommerce
CVEs publicadas que afetam produtos de Simplcommerce: 2 registro(s), com severidade, exploração e correções.
CVE-2026-9591
Média · 6.9
CWE-352 17/06/2026
Cross-Site Request Forgery (CSRF) in SimplCommerce News Module
Cross-site request forgery (CSRF) in NewsItemApiController in SimplCommerce prior to commit 6233d73e allows an unauthenticated remote attacker to create or modify news items as an administrator via a crafted form submitted to `/api/news-items`, due to missing anti-CSRF protection.
CVE-2026-11975
Média · 6.2
CWE-79 17/06/2026
Stored Cross-Site Scripting (XSS) in SimplCommerce News Module Admin Interface
Stored cross-site scripting (XSS) in NewsItemApiController In SimplCommerce prior to commit 6142d3b5 allows an authenticated administrator to execute arbitrary JavaScript via the ShortContent and FullContent fields, which are stored without HTML sanitization and rendered unencoded via @Html.Raw()