CVE-2022-21149
Cross-site Scripting (XSS)
The package s-cart/s-cart before 6.9; the package s-cart/core before 6.9 are vulnerable to Cross-site Scripting (XSS) which can lead to cookie stealing of any victim that visits the affected URL so the attacker can gain unauthorized access to that user's account through the stolen cookie.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Cross-site Scripting (XSS)
The package s-cart/s-cart before 6.9; the package s-cart/core before 6.9 are vulnerable to Cross-site Scripting (XSS) which can lead to cookie stealing of any victim that visits the affected URL so the attacker can gain unauthorized access to that user's account through the stolen cookie.
- Record
CVE-2022-21149- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
EUVDEUVD-2022-3039
The package s-cart/s-cart before 6.9; the package s-cart/core before 6.9 are vulnerable to Cross-site Scripting (XSS) which can lead to cookie stealing of any victim that visits the affected URL so the attacker can gain unauthorized access to that user's account through the stolen cookie.
- Record
EUVD-2022-3039- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7pfc-cx3m-v22x
SCart is vulnerable to cross-site scripting (XSS)
SCart e-commerce is a free open source for businesses, built on the Laravel framework. The package s-cart/s-cart before 6.9 and the package s-cart/core before 6.9 are vulnerable to cross-site Scripting (XSS) which can lead to cookie stealing of any victim that visits the affected URL. An attacker can gain unauthorized access to that user's account through the stolen cookie.
- Record
GHSA-7pfc-cx3m-v22x- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
The package s-cart/s-cart before 6.9; the package s-cart/core before 6.9 are vulnerable to Cross-site Scripting (XSS) which can lead to cookie stealing of any victim that visits the affected URL so the attacker can gain unauthorized access to that user's account through the stolen cookie.
- Record
CVE-2022-21149- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Cross-site Scripting (XSS)
The package s-cart/s-cart before 6.9; the package s-cart/core before 6.9 are vulnerable to Cross-site Scripting (XSS) which can lead to cookie stealing of any victim that visits the affected URL so the attacker can gain unauthorized access to that user's account through the stolen cookie.
- Record
CVE-2022-21149- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-7pfc-cx3m-v22x
SCart is vulnerable to cross-site scripting (XSS)
SCart e-commerce is a free open source for businesses, built on the Laravel framework. The package s-cart/s-cart before 6.9 and the package s-cart/core before 6.9 are vulnerable to cross-site Scripting (XSS) which can lead to cookie stealing of any victim that visits the affected URL. An attacker can gain unauthorized access to that user's account through the stolen cookie.
- Record
GHSA-7pfc-cx3m-v22x- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
s-cart/corePackagist |
before 6.9 | 6.9 |
s-cart/s-cartPackagist |
before 6.9 | 6.9 |
s-cart/corePackagist |
before 6.9, plus listed versions 4.0.04.0.0-beta4.0.14.0.1.14.0.1.2 Show 45 moreShow less4.0.1.34.0.1.44.0.1.54.1.04.1.0.14.1.0.24.1.0.34.1.0.44.1.0.54.1.14.2.04.2.14.2.1.14.2.1.24.2.1.34.2.1.44.2.1.54.2.2.04.2.2.14.2.2.24.2.3.04.3.04.3.0.14.3.14.3.1.14.3.1.24.3.2.04.4.0-beta4.4.0.04.4.0.14.4.0.24.4.0.34.4.0.44.4.0.54.4.1.04.4.1.14.4.2.04.5.04.5.14.5.25.0.05.0.0-beta5.0.15.0.25.0.2.1 |
6.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-21149 is a medium vulnerability (CVSS 5.4) in S-cart, published May 1, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in s-cart/core 6.9.
References
Left out here: 199 versions. The JSON record has them.