WS-2020-0427

In express-cart in versions 1.0.1 to 1.1.16 is vulnerable to CSRF. It allows attacker cheat admin to do bad behaviors . Main reason is csrf token isn't used...

WS-2019-0166

express-cart all versions are vulnerablre to Cross-Site Scripting In the admin page it is possible to inject arbitrary JavaScript as a new product option, allowing attackers to execute arbitrary code...

WS-2018-0196

Versions of express-cart before 1.1.8 are vulnerable to NoSQL injection...

EUVD-2019-0354

Malware in sbrugna...

EUVD-2021-1739

Malware in sbrugna...

EUVD-2022-2456

Malicious code in bioql PyPI...

CVE-2021-32573

The express-cart package through 1.1.10 for Node.js allows Reflected XSS for an admin via a user input field for product options. NOTE: the vendor states that this "would rely on an admin hacking his/her own website...

GHSA-HR89-W7P6-PJMQ express-cart allows any user to create an admin user

Express-Cart before 1.1.6 allows remote attackers to create an admin user via an /admin/setup Referer header...

express-cart allows any user to create an admin user

Express-Cart before 1.1.6 allows remote attackers to create an admin user via an /admin/setup Referer header...

GHSA-4W62-CQ5R-5MMQ express-cart unrestricted file upload vulnerability

Unrestricted file upload RCE in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine...

express-cart unrestricted file upload vulnerability

Unrestricted file upload RCE in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine...

Cross-Site Request Forgery in express-cart

The express-cart package through 1.1.10 for Node.js allows CSRF...

GHSA-H5Q8-5697-9P9H Cross-Site Request Forgery in express-cart

The express-cart package through 1.1.10 for Node.js allows CSRF...

CVE-2020-22403

Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...

CVE-2020-22403

Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...

CVE-2020-22403

Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...

CVE-2020-22403

CVE-2020-22403 affects the Express cart package for Node.js (v1.1.16). A CSRF vulnerability arises from missing/insufficient CSRF protections, enabling an attacker to perform unintended actions such as creating an administrator account or adding a discount code. The issue is confirmed across mult...

CVE-2020-22403

Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...

PT-2021-10761 · Npm · Express-Cart

Name of the Vulnerable Software and Affected Versions: Express cart versions 1.1.10 and earlier Express cart version 1.1.16 Description: A Cross Site Request Forgery CSRF issue allows attackers to add an administrator account, add a discount code, or have other unspecified impacts. This issue...