Tomatocart

Records5All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Tomatocart records in CISA KEV

No Tomatocart vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Tomatocart 5 records LOW

Records

5 records

TI-2012-04932 CVE-2012-5907 · GHSA-2xrv-6g4w-wcv4

Directory traversal vulnerability in json.php in TomatoCart 1.2.0 Alpha 2 and possibly…

LOW 33

Directory traversal vulnerability in json.php in TomatoCart 1.2.0 Alpha 2 and possibly earlier allows remote attackers to read arbitrary files via a ..

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.07651 Published 2012-11-17 No fix listed CWE-22

TI-2014-03245 CVE-2014-3978 · GHSA-qm7q-9vm6-pmvq

SQL injection vulnerability in TomatoCart 1.1.8.6.1 allows remote authenticated users to…

LOW 32

SQL injection vulnerability in TomatoCart 1.1.8.6.1 allows remote authenticated users to execute arbitrary SQL commands via the First Name and Last Name fields in a new address book contact.

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01727 Published 2014-10-20 No fix listed CWE-89

TI-2011-03368 CVE-2011-3811 · GHSA-4429-xcc5-9w5f

TomatoCart 1.1.3 allows remote attackers to obtain sensitive information via a direct…

LOW 25

TomatoCart 1.1.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by templates/system/offline.php and c…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01229 Published 2011-09-24 No fix listed CWE-200

TI-2014-03110 CVE-2014-3830 · GHSA-49mg-9ffp-9wjj

Cross-site scripting (XSS) vulnerability in info.php in TomatoCart 1.1.8.6.1 allows…

LOW 23

Cross-site scripting (XSS) vulnerability in info.php in TomatoCart 1.1.8.6.1 allows remote attackers to inject arbitrary web script or HTML via the faqs_id parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01427 Published 2014-10-20 No fix listed CWE-79

TI-2012-04171 CVE-2012-4934 · GHSA-hcxg-jpg7-wqg9

TomatoCart 1.1.7, when the PayPal Express Checkout module is enabled in sandbox mode…

LOW 20

TomatoCart 1.1.7, when the PayPal Express Checkout module is enabled in sandbox mode, allows remote authenticated users to bypass intended payment requirements by modifying a certain redirection URL.

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.01333 Published 2012-10-31 No fix listed CWE-264

Open these records in search →

Critical	0
High	0
Medium	4
Low	1
No CVSS	0