CVE-2021-27190

https://notcve.org/view.php?id=CVE-2021-27190

A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly available. The user supplied input containing polyglot payload is echoed back in javascript code in HTML response. This allows an attacker to input malicious JavaScript which can steal cookie, redirect them to other malicious website, etc. Se detectó una vulnerabilidad de Cross Site Scripting(XSS) almacenada en PEEL SHOPPING versiones 9.3.0 y 9.4.0, que están disponibles públicamente. La entrada suministrada por el usuario que contiene la carga útil de políglota se devuelve en código javascript en la respuesta HTML. • https://github.com/anmolksachan/CVE-2021-27190-PEEL-Shopping-cart-9.3.0-Stored-XSS https://github.com/advisto/peel-shopping/issues/4#issuecomment-953461611 https://github.com/vulf/Peel-Shopping-cart-9.4.0-Stored-XSS https://www.peel-shopping.com/modules/telechargement/telecharger.php?id=7 https://www.secuneus.com/cve-2021-27190-peel-shopping-ecommerce-shopping-cart-stored-cross-site-scripting-vulnerability-in-address • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •