[MEDIUM] EC-CUBE DOM-based cross-site scripting vulnerability

PKSA-kknk-hs9h-n1jp CVE-2022-38975 GHSA-pggw-rqfm-72rh

Affected version: >=4.0.0,<=4.1.2

Reported by:
GitHub

[LOW] EC-CUBE Directory traversal vulnerability

PKSA-v5y6-rjph-x47m CVE-2022-40199 GHSA-wjpv-frf2-3r58

Affected version: >=4.0.0,<=4.1.2|>=3.0.0,<=3.0.18-p4

Reported by:
GitHub

[MEDIUM] EC-CUBE Cross-site scripting vulnerability

PKSA-htqg-k9vx-vh65 CVE-2021-20751 GHSA-r6qq-qc9m-98w2

Affected version: >=4.0.0,<=4.0.5-p1

Reported by:
GitHub

[MEDIUM] EC-CUBE Cross-site scripting vulnerability

PKSA-fbnq-1prz-vy1w CVE-2021-20750 GHSA-vrpv-26fm-7vf7

Affected version: >=4.0.0,<=4.0.5-p1|>=3.0.0,<=3.0.18-p2

Reported by:
GitHub

[MEDIUM] EC-CUBE improperly handles HTTP Host header values

PKSA-3s8k-bkt9-x96b CVE-2022-25355 GHSA-pw97-6v74-9w3p

Affected version: >=4.0.0,<=4.1.1|>=3.0.0,<=3.0.18-p3

Reported by:
GitHub