CVE-2014-3737: Storesprite

Low severity, CVSS 2.6. EPSS: 2.1% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in templates/defaultheader.php in Lamp Design Storesprite before 7 - 19-06-14, when using the currency selection dropdown, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to brand.php, related to the currencyUrl function.

Affected products

• Storesprite Storesprite: up to and including 7_24-04-13

Published 2014-07-02. Last modified 2026-06-17.