Threats tagged 'ghsa-mmp7-8cg4-9wrg'

Magento Project Community Edition versions up to 2.4.7-p1 and certain earlier patched versions are affected by a stored Cross-Site Scripting (XSS) vulnerability (CVE-2024-39403). This flaw allows a low-privileged attacker to inject malicious JavaScript into vulnerable form fields, which executes in the browsers of users visiting those pages. The vulnerability has a high confidentiality impact due to potential exfiltration of sensitive information. Fixed versions have been released addressing this issue.