CVE-2022-50941

BootCommerce 3.2.1 contains persistent input validation vulnerabilities that allow remote attackers to inject malicious script code through guest order checkout input fields. Attackers can exploit unvalidated input parameters to execute arbitrary scripts, potentially leading to session hijacking, phishing attacks, and application module manipulation.

CVSS v4.0

5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

6.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

EPSS

0.31% chance of exploitation in the next 30 days, 24th percentile

Published

2026-02-01

Updated

2026-02-03

Proof-of-concept exploits (1)

• https://www.vulnerability-lab.com/get_content.php?id=2279

References

• CVE Record
• NVD entry

Related

• CVE-2022-50940
• CVE-2022-50942
• CVE-2022-50939
• CVE-2022-50943
• CVE-2022-50938
• CVE-2022-50944