7 results · Feed
-
High 8.8
Cross-Site Request Forgery in express-cart
Cross Site Request Forgery (CSRF) vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts.
-
Low —
Cross-Site Scripting in express-cart
All versions of `harp` are vulnerable to Cross-Site Scripting. In the admin page it is possible to inject arbitrary JavaScript as a new product option, allowing attackers to execute arbitrary code. This is limited to the admin page and does not affect other p…
-
High —
NoSQL injection in express-cart
Versions of `express-cart` before 1.1.8 are vulnerable to NoSQL injection. The vulnerability is caused by the lack of user input sanitization in the login handlers. In both cases, the customer login and the admin login, parameters from the JSON body are sent …
-
High —
Path Traversal in express-cart
Versions of `express-cart` before 1.1.7 are vulnerable to Path Traversal. ## Recommendation Update to version 1.1.7 or later.
-
High 8.8
Authentication Bypass by Spoofing in express-cart
A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.
-
High 8.8
express-cart allows any user to create an admin user
expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header.
-
High 8.8CVE-2018-3758 EPSS 27%
express-cart unrestricted file upload vulnerability
Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.