Filtered by vendor Optimizely Subscriptions
Filtered by product Configured Commerce Subscriptions

Search

Switch to Advanced Search (Beta)
Total 8 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-56175 1 Optimizely 1 Configured Commerce 2025-06-05 6.1 Medium
In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in list item names.
CVE-2024-56174 1 Optimizely 1 Configured Commerce 2025-06-05 8.1 High
In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in search history.
CVE-2024-56173 1 Optimizely 1 Configured Commerce 2025-06-05 4.7 Medium
In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from JavaScript in an SVG document.
CVE-2025-22387 1 Optimizely 1 Configured Commerce 2025-05-21 7.5 High
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session, which can be leveraged for session hijacking.
CVE-2025-22383 1 Optimizely 1 Configured Commerce 2025-05-20 4.6 Medium
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity input validation issue exists in the Commerce B2B application, affecting the Contact Us functionality. This allows visitors to send e-mail messages that could contain unfiltered HTML markup in specific scenarios.
CVE-2025-22384 1 Optimizely 1 Configured Commerce 2025-05-20 7.5 High
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific scenarios where requests are altered before reaching the server.
CVE-2025-22385 1 Optimizely 1 Configured Commerce 2025-05-20 5.9 Medium
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. For newly created accounts, the Commerce B2B application does not require email confirmation. This medium-severity issue allows the mass creation of accounts. This could affect database storage; also, non-requested storefront accounts can be created on behalf of visitors.
CVE-2025-22386 1 Optimizely 1 Configured Commerce 2025-05-20 7.3 High
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tied to logged-out sessions to still be active and usable.