CVE-2025-0974

A vulnerability was determined in MaxD Lightning Module 4.43/4.44 on OpenCart. This issue affects some unknown processing. Executing a manipulation of the argument liop/md can lead to deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The...

CVE-2025-22335

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rajib.dewan Opencart Product in WP opencart-product-in-wp allows Reflected XSS.This issue affects Opencart Product in WP: from n/a through = 1.0.1...

CVE-2025-0460

A vulnerability, which was classified as critical, was found in Blog Botz for Journal Theme 1.0 on OpenCart. This affects an unknown part of the file /index.php?route=extension/module/blogadd. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the atta...

CVE-2025-0579

A vulnerability was found in Shiprocket Module 3/4 on OpenCart. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php?route=extension/shiprocket/module/restapi of the component REST API Module. The manipulation of the argument x-userna...

CVE-2025-0841

A vulnerability has been found in Aridius XYZ up to 20240927 on OpenCart and classified as critical. This vulnerability affects the function loadMore of the component News. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the publi...

CVE-2024-21514

This affects versions of the package opencart/opencart from 0.0.0. An SQL Injection issue was identified in the Divido payment extension for OpenCart, which is included by default in version 3.0.3.9. As an anonymous unauthenticated user, if the Divido payment module is installed it does not have ...

CVE-2024-21518

This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted to arbitrary locations. An...

CVE-2025-0974

A vulnerability was determined in MaxD Lightning Module 4.43/4.44 on OpenCart. This issue affects some unknown processing. Executing a manipulation of the argument liop/md can lead to deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The...

CVE-2025-0974

A vulnerability was determined in MaxD Lightning Module 4.43/4.44 on OpenCart. This issue affects some unknown processing. Executing a manipulation of the argument liop/md can lead to deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The...

CVE-2025-0974 MaxD Lightning Module deserialization

A vulnerability was determined in MaxD Lightning Module 4.43/4.44 on OpenCart. This issue affects some unknown processing. Executing a manipulation of the argument liop/md can lead to deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The...

CVE-2025-0974

CVE-2025-0974 affects MaxD Lightning Module 4.43 on OpenCart. The issue is a deserialization vulnerability triggered by the li_op/md argument, enabling remote-style manipulation with high attack complexity and LOW confidentiality/integrity/availability impact per sources. Several advisories repor...

PT-2025-4120 · Unknown +1 · Maxd Lightning Module +1

Name of the Vulnerable Software and Affected Versions: MaxD Lightning Module version 4.43 on OpenCart Description: A critical issue has been found in the MaxD Lightning Module on OpenCart, affecting some unknown processing. The manipulation of the argument li op/md leads to deserialization. The...

OpenCart Lightning 代码问题漏洞

OpenCart Lightning is an OpenCart extension from OpenCart, Inc. A code issue vulnerability exists in OpenCart Lightning version 4.43 that stems from a deserialization issue with the parameter liop/md...

CVE-2025-0841

A vulnerability has been found in Aridius XYZ up to 20240927 on OpenCart and classified as critical. This vulnerability affects the function loadMore of the component News. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the publi...

CVE-2025-0841 Aridius XYZ News loadMore deserialization

A vulnerability has been found in Aridius XYZ up to 20240927 on OpenCart and classified as critical. This vulnerability affects the function loadMore of the component News. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the publi...

CVE-2025-0841

CVE-2025-0841 affects Aridius XYZ up to 20240927 on OpenCart, impacting the News component’s loadMore function. The issue is a deserialization flaw that can be triggered remotely, potentially enabling an attacker to manipulate and execute partial impacts as described across multiple sources. Expl...

OpenCart Aridius 代码问题漏洞

OpenCart Aridius is an OpenCart extension from OpenCart, Inc. A code issue vulnerability exists in OpenCart Aridius XYZ 20240927 and earlier versions, which stems from a deserialization issue in the loadMore function of the News component...

OpenCart Injection Vulnerability

OpenCart is a set of open source e-commerce system from China OpenCart team. The system provides product reviews, product ratings, product additions and other modules. An injection vulnerability exists in OpenCart version 4.0.0.1, which originates from the parameter headermenuid in the...

CVE-2025-0579

A vulnerability was found in Shiprocket Module 3/4 on OpenCart. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php?route=extension/shiprocket/module/restapi of the component REST API Module. The manipulation of the argument x-userna...

CVE-2025-0580

CVE-2025-0580 affects Shiprocket Module 3 on OpenCart. The vulnerability resides in the REST API Module’s file path /index.php?route=extension/module/rest_api&action=getOrders, where manipulating the contentHash argument leads to incorrect authorization. It is described as remotely exploitable wi...