CVE-2021-27190

A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly available. The user supplied input containing polyglot payload is echoed back in javascript code in HTML response. This allows an attacker to input malicious JavaScript which can steal cookie, redirect them to other malicious website, etc.

• CWE-79

• https://github.com/advisto/peel-shopping/issues/4#issuecomment-953461611Patch, Third Party Advisory
• https://github.com/anmolksachan/CVE-2021-27190-PEEL-Shopping-cart-9.3.0-Stored-XSSExploit, Third Party Advisory
• https://github.com/vulf/Peel-Shopping-cart-9.4.0-Stored-XSSExploit, Third Party Advisory
• https://www.peel-shopping.com/modules/telechargement/telecharger.php?id=7Product, Vendor Advisory
• https://www.secuneus.com/cve-2021-27190-peel-shopping-ecommerce-shopping-cart-stored-cross-site-scripting-vulnerability-in-address/Exploit, Third Party Advisory
• https://github.com/advisto/peel-shopping/issues/4#issuecomment-953461611Patch, Third Party Advisory
• https://github.com/anmolksachan/CVE-2021-27190-PEEL-Shopping-cart-9.3.0-Stored-XSSExploit, Third Party Advisory
• https://github.com/vulf/Peel-Shopping-cart-9.4.0-Stored-XSSExploit, Third Party Advisory
• https://www.peel-shopping.com/modules/telechargement/telecharger.php?id=7Product, Vendor Advisory
• https://www.secuneus.com/cve-2021-27190-peel-shopping-ecommerce-shopping-cart-stored-cross-site-scripting-vulnerability-in-address/Exploit, Third Party Advisory

Published

Feb 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-27184Pelco Digital Sentry Server 7.18.72.11464 has an XML Externa…7.5
• CVE-2021-27185The samba-client package before 4.0.0 for Node.js allows com…9.8
• CVE-2021-27186Fluent Bit 1.6.10 has a NULL pointer dereference when an flb…7.5
• CVE-2021-27187The Sovremennye Delovye Tekhnologii FX Aggregator terminal c…7.5
• CVE-2021-27188The Sovremennye Delovye Tekhnologii FX Aggregator terminal c…7.5
• CVE-2021-27189The CIRA Canadian Shield app before 4.0.13 for iOS lacks SSL…5.9
• CVE-2021-27191The get-ip-range package before 4.0.0 for Node.js is vulnera…7.5
• CVE-2021-27192Local privilege escalation vulnerability in Windows clients …7.8
• CVE-2021-27193Incorrect default permissions vulnerability in the API of Ne…9.8
• CVE-2021-27194Cleartext transmission of sensitive information in Netop Vis…8.8
• CVE-2021-27195Improper Authorization vulnerability in Netop Vision Pro up …5.9
• CVE-2021-27196Improper Input Validation vulnerability in Hitachi ABB Power…7.5