Vendors / Kartatopia Records 3 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 3
Exploited now Kartatopia records in CISA KEV No Kartatopia vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 77
PilusCart 1.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'send' parameter.
CVSS 4.0 HIGH 8.8· Network · No auth · No interaction · EPSS 0.00392 · Published 2026-04-05 · No fix listed CWE-89
Priority MEDIUM 50
In Kartatopia PilusCart 1.4.1, the parameter filename in the file catalog.php is mishandled, leading to ../ Local File Disclosure.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.16619 · Published 2019-09-09 · No fix listed CWE-22
Priority MEDIUM 42
PilusCart 1.4.1 is vulnerable to index.php?module=users&action=newUser CSRF, leading to the addition of a new user as administrator.
CVSS 3.0 HIGH 8.8· Network · No auth · User interaction · EPSS 0.02277 · Published 2019-03-14 · No fix listed CWE-352
Open these records in search → All records by CVSS severity
0 3 0 0 0
