68 matches found
WS-2020-0427
In express-cart in versions 1.0.1 to 1.1.16 is vulnerable to CSRF. It allows attacker cheat admin to do bad behaviors . Main reason is csrf token isn't used...
WS-2019-0166
express-cart all versions are vulnerablre to Cross-Site Scripting In the admin page it is possible to inject arbitrary JavaScript as a new product option, allowing attackers to execute arbitrary code...
WS-2018-0196
Versions of express-cart before 1.1.8 are vulnerable to NoSQL injection...
EUVD-2019-0354
Malware in sbrugna...
EUVD-2021-1739
Malware in sbrugna...
EUVD-2022-2456
Malicious code in bioql PyPI...
CVE-2021-32573
The express-cart package through 1.1.10 for Node.js allows Reflected XSS for an admin via a user input field for product options. NOTE: the vendor states that this "would rely on an admin hacking his/her own website...
GHSA-HR89-W7P6-PJMQ express-cart allows any user to create an admin user
Express-Cart before 1.1.6 allows remote attackers to create an admin user via an /admin/setup Referer header...
express-cart allows any user to create an admin user
Express-Cart before 1.1.6 allows remote attackers to create an admin user via an /admin/setup Referer header...
GHSA-4W62-CQ5R-5MMQ express-cart unrestricted file upload vulnerability
Unrestricted file upload RCE in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine...
express-cart unrestricted file upload vulnerability
Unrestricted file upload RCE in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine...
Cross-Site Request Forgery in express-cart
The express-cart package through 1.1.10 for Node.js allows CSRF...
GHSA-H5Q8-5697-9P9H Cross-Site Request Forgery in express-cart
The express-cart package through 1.1.10 for Node.js allows CSRF...
CVE-2020-22403
Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...
CVE-2020-22403
Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...
Cross site request forgery (csrf)
Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...
CVE-2020-22403: Cross-Site Request Forgery (CSRF)
Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...
CVE-2020-22403
Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...
CVE-2020-22403
Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...
PT-2021-10761 · Npm · Express-Cart
Name of the Vulnerable Software and Affected Versions: Express cart versions 1.1.10 and earlier Express cart version 1.1.16 Description: A Cross Site Request Forgery CSRF issue allows attackers to add an administrator account, add a discount code, or have other unspecified impacts. This issue...