WS-2020-0427

In express-cart in versions 1.0.1 to 1.1.16 is vulnerable to CSRF. It allows attacker cheat admin to do bad behaviors . Main reason is csrf token isn't used...

WS-2019-0166

express-cart all versions are vulnerablre to Cross-Site Scripting In the admin page it is possible to inject arbitrary JavaScript as a new product option, allowing attackers to execute arbitrary code...

WS-2018-0196

Versions of express-cart before 1.1.8 are vulnerable to NoSQL injection...

EUVD-2019-0354

Malware in sbrugna...

EUVD-2021-1739

Malware in sbrugna...

EUVD-2022-2456

Malicious code in bioql PyPI...

CVE-2021-32573

The express-cart package through 1.1.10 for Node.js allows Reflected XSS for an admin via a user input field for product options. NOTE: the vendor states that this "would rely on an admin hacking his/her own website...

express-cart allows any user to create an admin user

Express-Cart before 1.1.6 allows remote attackers to create an admin user via an /admin/setup Referer header...

GHSA-HR89-W7P6-PJMQ express-cart allows any user to create an admin user

Express-Cart before 1.1.6 allows remote attackers to create an admin user via an /admin/setup Referer header...

GHSA-4W62-CQ5R-5MMQ express-cart unrestricted file upload vulnerability

Unrestricted file upload RCE in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine...

express-cart unrestricted file upload vulnerability

Unrestricted file upload RCE in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine...

GHSA-H5Q8-5697-9P9H Cross-Site Request Forgery in express-cart

The express-cart package through 1.1.10 for Node.js allows CSRF...

Cross-Site Request Forgery in express-cart

The express-cart package through 1.1.10 for Node.js allows CSRF...

CVE-2020-22403

Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...

CVE-2020-22403

Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...

CVE-2020-22403

Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...

CVE-2020-22403

CVE-2020-22403 affects the Express cart package for Node.js (v1.1.16). A CSRF vulnerability arises from missing/insufficient CSRF protections, enabling an attacker to perform unintended actions such as creating an administrator account or adding a discount code. The issue is confirmed across mult...

express-cart 跨站请求伪造漏洞

express-cart is a shopping cart module used in Node.js. A cross-site request forgery vulnerability exists in express-cart in Node.js, which stems from a WEB application that does not adequately validate that a request is coming from a trusted user. An attacker could use this vulnerability to send...

CVE-2020-22403: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...