Vulnerabilities

TI-2020-13411 CVE-2020-18477 · GHSA-qq3q-x8cf-gqg9

SQL Injection vulnerability in Hucart CMS 5.7.4 via the purchase enquiry field found in the Message con_content field.

MEDIUM 40

SQL Injection vulnerability in Hucart CMS 5.7.4 via the purchase enquiry field found in the Message con_content field.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00887 Published 2021-08-26 No fix listed CWE-89

TI-2020-13410 CVE-2020-18476 · GHSA-fh36-32fh-3hhg

SQL Injection vulnerability in Hucart CMS 5.7.4 via the basic information field found in the avatar usd_image field.

MEDIUM 40

SQL Injection vulnerability in Hucart CMS 5.7.4 via the basic information field found in the avatar usd_image field.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00887 Published 2021-08-26 No fix listed CWE-89

TI-2020-13409 CVE-2020-18475 · GHSA-hgfp-jcxr-8j6r

Cross Site Scripting (XSS) vulnerabilty exists in Hucart CMS 5.7.4 is via the mes_title…

LOW 25

Cross Site Scripting (XSS) vulnerabilty exists in Hucart CMS 5.7.4 is via the mes_title field.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0045 Published 2021-08-26 No fix listed CWE-79

TI-2020-13328 CVE-2020-18158 · GHSA-32x5-p6vh-hgrq

Cross Site Scripting (XSS) vulnerability in HuCart 5.7.4 via nickname in index.php.

LOW 25

Cross Site Scripting (XSS) vulnerability in HuCart 5.7.4 via nickname in index.php.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00625 Published 2021-07-29 No fix listed CWE-79

TI-2019-04447 CVE-2019-6249 · GHSA-8q7h-74c4-rwvx

An issue was discovered in HuCart v5.7.4.

MEDIUM 43

An issue was discovered in HuCart v5.7.4.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.02979 Published 2019-01-13 No fix listed CWE-352

TI-2018-13787 CVE-2018-19468 · GHSA-gfcg-rp87-5hw8

HuCart 5.7.4 has SQL injection in get_ip() in system/class/helper_class.php via the…

MEDIUM 44

HuCart 5.7.4 has SQL injection in get_ip() in system/class/helper_class.php via the X-Forwarded-For HTTP header to the user/index.php?load=login&act=act_login URI.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01135 Published 2018-11-23 No fix listed CWE-89

Vulnerabilities

Filters

SQL Injection vulnerability in Hucart CMS 5.7.4 via the purchase enquiry field found in the Message con_content field.

SQL Injection vulnerability in Hucart CMS 5.7.4 via the basic information field found in the avatar usd_image field.

Cross Site Scripting (XSS) vulnerabilty exists in Hucart CMS 5.7.4 is via the mes_title…

Cross Site Scripting (XSS) vulnerability in HuCart 5.7.4 via nickname in index.php.

An issue was discovered in HuCart v5.7.4.

HuCart 5.7.4 has SQL injection in get_ip() in system/class/helper_class.php via the…