OpenCart Cross-Site Scripting Vulnerability

A Cross-Site Scripting (XSS) vulnerability exists in OpenCart versions prior to 4.1.0. This issue allows attackers to execute JavaScript in the victim's browser by sending a malicious URL through the search feature on the /product/search endpoint. Exploitation of this vulnerability could lead to the theft of sensitive user information, such as session cookies, or allow actions to be performed on behalf of the user.

Impact

Exploitation of this vulnerability could result in Cross-Site Scripting, allowing for the execution of malicious scripts in the context of the user's browser.

Remediation

Users can upgrade to OpenCart version 4.1.0 or later to address this vulnerability.