Vulnerabilities

TI-2020-14335 CVE-2020-22403 · GHSA-h5q8-5697-9p9h

Cross Site Request Forgery (CSRF) vulnerability in Express cart v1.1.16 allows attackers…

LOW 39

Cross Site Request Forgery (CSRF) vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00567 Published 2021-08-12 Fixed in 1.1.17 CWE-352

TI-2021-12245 CVE-2021-32573 · GHSA-mpgq-6jmr-6c67

The express-cart package through 1.1.10 for Node.js allows Reflected XSS (for an admin)…

LOW 23

The express-cart package through 1.1.10 for Node.js allows Reflected XSS (for an admin) via a user input field for product options.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00527 Published 2021-05-11 No fix listed CWE-79

TI-2018-11825 CVE-2018-16483 · GHSA-wj36-v8j4-pc7c

Authentication bypass by spoofing in HackerOne express-cart

MEDIUM 40

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01156 Published 2019-02-01 Fixed in 1.1.6 CWE-290

TI-2018-02754 CVE-2018-3758 · GHSA-4w62-cq5r-5mmq

Path traversal in HackerOne express-cart

MEDIUM 60

Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.27071 Published 2018-06-07 Fixed in 1.1.7 CWE-22

Vulnerabilities

Filters

Cross Site Request Forgery (CSRF) vulnerability in Express cart v1.1.16 allows attackers…

The express-cart package through 1.1.10 for Node.js allows Reflected XSS (for an admin)…

Authentication bypass by spoofing in HackerOne express-cart

Path traversal in HackerOne express-cart