Vulnerability · Published May 5, 2026 · Assigned by VulnCheck
CVE-2023-54349AmazCart CMS 3.4 Reflected Cross-Site Scripting via Search
Medium 6.1
In plain English
A medium-severity cross-site scripting in AmazCart CMS from Spondonit. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.3%top 81.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
AmazCart CMS 3.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the search functionality. Attackers can enter script tags in the search box to execute arbitrary JavaScript that fires when search history is viewed or results are displayed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spondonit | AmazCart CMS | 3.4 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- ExploitDB-51219 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: AmazCart CMS 3.4 Reflected Cross-Site Scripting via Search third-party-advisory