CVE-2025-0841

CVE-2025-0841 affects Aridius XYZ up to 20240927 on OpenCart, impacting the News component’s loadMore function. The issue is a deserialization flaw that can be triggered remotely, potentially enabling an attacker to manipulate and execute partial impacts as described across multiple sources. Expl...

OpenCart Aridius 代码问题漏洞

OpenCart Aridius is an OpenCart extension from OpenCart, Inc. A code issue vulnerability exists in OpenCart Aridius XYZ 20240927 and earlier versions, which stems from a deserialization issue in the loadMore function of the News component...

OpenCart Injection Vulnerability

OpenCart is a set of open source e-commerce system from China OpenCart team. The system provides product reviews, product ratings, product additions and other modules. An injection vulnerability exists in OpenCart version 4.0.0.1, which originates from the parameter headermenuid in the...

CVE-2025-0579

A vulnerability was found in Shiprocket Module 3/4 on OpenCart. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php?route=extension/shiprocket/module/restapi of the component REST API Module. The manipulation of the argument x-userna...

CVE-2025-0580

CVE-2025-0580 affects Shiprocket Module 3 on OpenCart. The vulnerability resides in the REST API Module’s file path /index.php?route=extension/module/rest_api&action=getOrders, where manipulating the contentHash argument leads to incorrect authorization. It is described as remotely exploitable wi...

Shiprocket Module 3 on OpenCart 注入漏洞

Shiprocket Module 3 on OpenCart is a shipping module from Shiprocket. An injection vulnerability exists in Shiprocket Module 3 on OpenCart version v3 and v4, which stems from the parameter x-username in the file /index.php?route=extension/shiprocket/module/restapi that can lead to SQL injection...

PT-2025-3971 · Opencart +1 · Opencart +1

The Shiprocket Module 3 on OpenCart is affected by a critical issue, where the manipulation of the contentHash argument in the REST API Module leads to incorrect authorization 🚨. This allows for remote attacks, although the complexity is rather high and exploitation is known to be difficult. The...

CVE-2025-0460

A vulnerability, which was classified as critical, was found in Blog Botz for Journal Theme 1.0 on OpenCart. This affects an unknown part of the file /index.php?route=extension/module/blogadd. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the atta...

CVE-2025-0460 Blog Botz for Journal Theme blog_add unrestricted upload

A vulnerability, which was classified as critical, was found in Blog Botz for Journal Theme 1.0 on OpenCart. This affects an unknown part of the file /index.php?route=extension/module/blogadd. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the atta...

OpenCart 安全漏洞

OpenCart is a set of open source e-commerce system from China OpenCart team. The system provides product reviews, product ratings, product additions and other modules. A file upload vulnerability exists in OpenCart version 1.0, which stems from the lack of effective validation of uploaded files b...

PT-2025-3896 · Opencart · Blog Botz For Journal Theme

Name of the Vulnerable Software and Affected Versions: Blog Botz for Journal Theme version 1.0 on OpenCart Description: A critical vulnerability was found in Blog Botz for Journal Theme on OpenCart, affecting an unknown part of the file /index.php?route=extension/module/blog add. The manipulation...

Server-side Template Injection (SSTI)

opencart/opencart is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper validation and sanitization of user inputs within the Theme Editor Function, allows attackers to inject malicious template code that can be executed on the server...

CVE-2025-22335

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rajib.dewan Opencart Product in WP opencart-product-in-wp allows Reflected XSS.This issue affects Opencart Product in WP: from n/a through = 1.0.1...

CVE-2025-22335

CVE-2025-22335 is a reflected XSS affecting the Opencart Product in WP plugin. Public details show the issue applies to Opencart Product in WP versions up to 1.0.1 and is caused by improper input neutralization during web page generation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) ...

CVE-2025-22335 WordPress Opencart Product in WP plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rajib.dewan Opencart Product in WP opencart-product-in-wp allows Reflected XSS.This issue affects Opencart Product in WP: from n/a through = 1.0.1...

CVE-2025-22335 WordPress Opencart Product in WP plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rajib.dewan Opencart Product in WP opencart-product-in-wp allows Reflected XSS.This issue affects Opencart Product in WP: from n/a through = 1.0.1...

PT-2025-4450 · WordPress · Opencart Product In Wp

Name of the Vulnerable Software and Affected Versions: Opencart Product in WP versions 1.0.0 through 1.0.1 Description: The issue is related to improper neutralization of input during web page generation, which allows reflected cross-site scripting XSS. This means an attacker can inject malicious...

WordPress plugin Opencart Product in WP 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2025-0214

A vulnerability was found in TMD Custom Header Menu 4.0.0.1 on OpenCart. It has been rated as problematic. This issue affects some unknown processing of the file /admin/index.php. The manipulation of the argument headermenuid leads to sql injection. The attack may be initiated remotely. The...

CVE-2025-0214

CVE-2025-0214 affects OpenCart/OpenCart module TMD Custom Header Menu 4.0.0.1. The vulnerability resides in the admin/index.php processing of the headermenu_id parameter, allowing SQL injection with remote access. Impact is stated as partial confidentiality/integrity/availability implications per...