{"action":"Upgrade shuup to 2.11.0 or later.","affected":[{"fixed":"2.11.0","introduced":"1.6.0"}],"component":"shuup","cve_ids":["CVE-2021-25963"],"ecosystem":"PyPI","epss":0.00955,"exploited":false,"fixed_versions":["2.11.0"],"ghsa_id":"GHSA-5pcx-vqjp-p34w","id":"tcs_01M5KGCH8GFZJ7V7BZP3MA2QEN","modified_at":"2023-11-08T04:05:19.003961Z","published_at":"2021-09-30T08:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-350","https://github.com/shuup/shuup/commit/75714c37e32796eb7cbb0d977af5bcaa26573588","https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25963","https://github.com/advisories/GHSA-5pcx-vqjp-p34w"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-350","url":"https://osv.dev/vulnerability/PYSEC-2021-350"}],"summary":"In Shuup, versions 1.6.0 through 2.10.8 are vulnerable to reflected Cross-Site Scripting (XSS) that allows execution of arbitrary javascript code on a victim browser. This vulnerability exists due to"}