What is CVE-2024-58304?

CVE-2024-58304 is a high-severity vulnerability in Spa-Cart Cms, classified under Cross-site Scripting. CVSS score: 7.5/10. Published 2025-12-11.

How severe is CVE-2024-58304?

High severity. CVSS v3 base score is 7.5 out of 10.

XSS in Spa-Cart Cms

CVE-2024-58304

SPA-CART CMS 1.9.0.3 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticated administrators to inject malicious scripts. Attackers can submit JavaScript payloads through the 'descr' parameter in the product edit form to execute arbitrary code in administrative users' browsers.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.004 (34.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Spa-cart Cms — versions 1.9.0.3

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

ExploitDB-51919 (exploit)
VulnCheck Advisory: SPA-CART CMS 1.9.0.3 Stored Cross-Site Scripting via Product Description (third-party-advisory)

Frequently asked questions

What is CVE-2024-58304?: CVE-2024-58304 is a high-severity vulnerability in Spa-Cart Cms, classified under Cross-site Scripting. CVSS score: 7.5/10. Published 2025-12-11.
How severe is CVE-2024-58304?: High severity. CVSS v3 base score is 7.5 out of 10.