TI-2018-02754 CVE-2018-3758 · GHSA-4w62-cq5r-5mmq
Path traversal in HackerOne express-cart
Priority MEDIUM 60
Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.
Express-cart Project
Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
Express-cart Project records in CISA KEVNo Express-cart Project vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
4 records
TI-2018-11825 CVE-2018-16483 · GHSA-wj36-v8j4-pc7c
Authentication bypass by spoofing in HackerOne express-cart
Priority MEDIUM 40
A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.
TI-2020-14335 CVE-2020-22403 · GHSA-h5q8-5697-9p9h
Cross Site Request Forgery (CSRF) vulnerability in Express cart v1.1.16 allows attackers…
Priority LOW 39
Cross Site Request Forgery (CSRF) vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts.
TI-2021-12245 CVE-2021-32573 · GHSA-mpgq-6jmr-6c67
The express-cart package through 1.1.10 for Node.js allows Reflected XSS (for an admin)…
Priority LOW 23
The express-cart package through 1.1.10 for Node.js allows Reflected XSS (for an admin) via a user input field for product options.