CVE-2024-58304 MEDIUM

CVE-2024-58304: SPA-CART CMS 1.9.0.3 Stored Cross-Site Scripting

Vendor Spa-Cart
Product SPA-CART CMS
Weakness CWE-79 · XSS
Published December 11, 2025
Last update April 7, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

SPA-CART CMS 1.9.0.3 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticated administrators to inject malicious scripts. Attackers can submit JavaScript payloads through the 'descr' parameter in the product edit form to execute arbitrary code in administrative users' browsers.

Key dates

02Disclosure timeline

December 11, 2025 CVE published
April 7, 2026 Record updated