Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Welcart e-Commerce 2.8.5 Clear all filters
TI-2022-03879 CVE-2022-4236 · GHSA-h2jj-vr3r-h3v5

Welcart e-Commerce < 2.8.5 - Subscriber+ Arbitrary File Access

Priority MEDIUM 62

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a ro…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00852 Published 2023-01-02 Fixed in 2.8.5 CWE-552
TI-2022-03786 CVE-2022-4140 · GHSA-6c75-m6fq-9mh7

Welcart e-Commerce < 2.8.5 - Unauthenticated Arbitrary File Access

Priority HIGH 72

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03175 Published 2023-01-02 Fixed in 2.8.5