CVE-2026-36766 - Multiple authenticated cross-site scripting (XSS) vulnerabilities in the XssHttpServletRequestWrapper class of shopizer v3.2.5 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the getInputStream() or getReader() functions

Back Back to CVE browser

MEDIUM

Multiple authenticated cross-site scripting (XSS) vulnerabilities in the XssHttpServletRequestWrapper class of shopizer v3.2.5 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the getInputStream() or getReader() functions

Published Apr 30, 2026

5.4

MEDIUM

CVSS 3.1

EPSS 0.24%

Description

Multiple authenticated cross-site scripting (XSS) vulnerabilities in the XssHttpServletRequestWrapper class of shopizer v3.2.5 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the getInputStream() or getReader() functions.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

Link	Providers	Tags
https://github.com/advisories/GHSA-fqcw-2xhj-p63g		Advisory
https://github.com/shopizer-ecommerce/shopizer
https://github.com/shopizer-ecommerce/shopizer/issues/1093		exploit
https://nvd.nist.gov/vuln/detail/CVE-2026-36766