Shiprocket Module 3 on OpenCart 注入漏洞

Shiprocket Module 3 on OpenCart is a shipping module from Shiprocket. An injection vulnerability exists in Shiprocket Module 3 on OpenCart version v3 and v4, which stems from the parameter x-username in the file /index.php?route=extension/shiprocket/module/restapi that can lead to SQL injection...

PT-2025-3971 · Opencart +1 · Opencart +1

The Shiprocket Module 3 on OpenCart is affected by a critical issue, where the manipulation of the contentHash argument in the REST API Module leads to incorrect authorization 🚨. This allows for remote attacks, although the complexity is rather high and exploitation is known to be difficult. The...

CVE-2025-0460

A vulnerability, which was classified as critical, was found in Blog Botz for Journal Theme 1.0 on OpenCart. This affects an unknown part of the file /index.php?route=extension/module/blogadd. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the atta...

CVE-2025-0460 Blog Botz for Journal Theme blog_add unrestricted upload

A vulnerability, which was classified as critical, was found in Blog Botz for Journal Theme 1.0 on OpenCart. This affects an unknown part of the file /index.php?route=extension/module/blogadd. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the atta...

OpenCart 安全漏洞

OpenCart is a set of open source e-commerce system from China OpenCart team. The system provides product reviews, product ratings, product additions and other modules. A file upload vulnerability exists in OpenCart version 1.0, which stems from the lack of effective validation of uploaded files b...

PT-2025-3896 · Opencart · Blog Botz For Journal Theme

Name of the Vulnerable Software and Affected Versions: Blog Botz for Journal Theme version 1.0 on OpenCart Description: A critical vulnerability was found in Blog Botz for Journal Theme on OpenCart, affecting an unknown part of the file /index.php?route=extension/module/blog add. The manipulation...

Server-side Template Injection (SSTI)

opencart/opencart is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper validation and sanitization of user inputs within the Theme Editor Function, allows attackers to inject malicious template code that can be executed on the server...

CVE-2025-22335

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rajib.dewan Opencart Product in WP opencart-product-in-wp allows Reflected XSS.This issue affects Opencart Product in WP: from n/a through = 1.0.1...

CVE-2025-22335

CVE-2025-22335 is a reflected XSS affecting the Opencart Product in WP plugin. Public details show the issue applies to Opencart Product in WP versions up to 1.0.1 and is caused by improper input neutralization during web page generation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) ...

CVE-2025-22335 WordPress Opencart Product in WP plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rajib.dewan Opencart Product in WP opencart-product-in-wp allows Reflected XSS.This issue affects Opencart Product in WP: from n/a through = 1.0.1...

CVE-2025-22335 WordPress Opencart Product in WP plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rajib.dewan Opencart Product in WP opencart-product-in-wp allows Reflected XSS.This issue affects Opencart Product in WP: from n/a through = 1.0.1...

PT-2025-4450 · WordPress · Opencart Product In Wp

Name of the Vulnerable Software and Affected Versions: Opencart Product in WP versions 1.0.0 through 1.0.1 Description: The issue is related to improper neutralization of input during web page generation, which allows reflected cross-site scripting XSS. This means an attacker can inject malicious...

WordPress plugin Opencart Product in WP 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2025-0214

A vulnerability was found in TMD Custom Header Menu 4.0.0.1 on OpenCart. It has been rated as problematic. This issue affects some unknown processing of the file /admin/index.php. The manipulation of the argument headermenuid leads to sql injection. The attack may be initiated remotely. The...

CVE-2025-0214

CVE-2025-0214 affects OpenCart/OpenCart module TMD Custom Header Menu 4.0.0.1. The vulnerability resides in the admin/index.php processing of the headermenu_id parameter, allowing SQL injection with remote access. Impact is stated as partial confidentiality/integrity/availability implications per...

CVE-2025-0214 TMD Custom Header Menu index.php sql injection

A vulnerability was found in TMD Custom Header Menu 4.0.0.1 on OpenCart. It has been rated as problematic. This issue affects some unknown processing of the file /admin/index.php. The manipulation of the argument headermenuid leads to sql injection. The attack may be initiated remotely. The...

CVE-2025-0214 TMD Custom Header Menu index.php sql injection

A vulnerability was found in TMD Custom Header Menu 4.0.0.1 on OpenCart. It has been rated as problematic. This issue affects some unknown processing of the file /admin/index.php. The manipulation of the argument headermenuid leads to sql injection. The attack may be initiated remotely. The...

OpenCart 注入漏洞

OpenCart is a set of open source e-commerce system from China OpenCart team. The system provides product reviews, product ratings, product additions and other modules. An injection vulnerability exists in OpenCart version 4.0.0.1, which originates from the parameter headermenuid in the...

WordPress Opencart Product in WP plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Opencart Product in WP versions = 1.0.1...

GHSA-J2V2-3784-VR44 Duplicate Advisory: openCart Server-Side Template Injection (SSTI) vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xrh7-2gfq-4rcq. This link is maintained to preserve external references. Original Description OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection SSTI via the Theme Editor Function...