CVE-2021-33562

A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via the ref parameter to a page about an arbitrary product, e.g., a product/insert-product-name-here.html/ref= URL.

• CWE-79

• https://github.com/shopizer-ecommerce/shopizer/commit/197f8c78c8f673b957e41ca2c823afc654c19271Patch, Third Party Advisory
• https://github.com/shopizer-ecommerce/shopizer/compare/2.16.0...2.17.0Patch, Third Party Advisory
• https://www.exploit-db.com/exploits/49901Exploit, Third Party Advisory, VDB Entry
• https://github.com/shopizer-ecommerce/shopizer/commit/197f8c78c8f673b957e41ca2c823afc654c19271Patch, Third Party Advisory
• https://github.com/shopizer-ecommerce/shopizer/compare/2.16.0...2.17.0Patch, Third Party Advisory
• https://www.exploit-db.com/exploits/49901Exploit, Third Party Advisory, VDB Entry

Published

May 24, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33554Multiple camera devices by UDP Technology, Geutebrück and ot…7.2
• CVE-2021-33555In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.7 the filename …7.5
• CVE-2021-33557An XSS issue was discovered in manage_custom_field_edit_page…6.1
• CVE-2021-33558Boa 0.94.13 allows remote attackers to obtain sensitive info…7.5
• CVE-2021-33560Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElG…7.5
• CVE-2021-33561A stored cross-site scripting (XSS) vulnerability in Shopize…4.8
• CVE-2021-33563Koel before 5.1.4 lacks login throttling, lacks a password s…7.5
• CVE-2021-33564An argument injection vulnerability in the Dragonfly gem bef…9.8
• CVE-2021-33570Postbird 0.8.4 allows stored XSS via the onerror attribute o…5.4
• CVE-2021-33571In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 befo…7.5
• CVE-2021-33572A Denial-of-Service (DoS) vulnerability was discovered in F-…6.5
• CVE-2021-33574The mq_notify function in the GNU C Library (aka glibc) vers…9.8