SPA-Cart

Records7All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

SPA-Cart records in CISA KEV

No SPA-Cart vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

2 records in Spa-cart · all components

TI-2023-23119 CVE-2023-43149 · GHSA-f42h-c5pj-9hxp

HIGH 73

SPA-Cart 1.9.0.3 is vulnerable to Cross Site Request Forgery (CSRF) that allows a remote attacker to add an admin user with role status.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00682 Published 2023-10-12 No fix listed CWE-352

TI-2023-23118 CVE-2023-43148 · GHSA-p7g5-687r-f7jc

HIGH 70

SPA-Cart 1.9.0.3 has a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to delete all accounts.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00613 Published 2023-10-12 No fix listed CWE-352