PT-2025-9101 · Opencart · Opencart

Name of the Vulnerable Software and Affected Versions: OpenCart versions prior to 4.1.0 Description: The issue allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL using the search in the "/product/search" endpoint. This could be exploited to steal...

OpenCart 跨站脚本漏洞

OpenCart is an open source e-commerce system by the Chinese OpenCart team. The system provides modules for product reviews, product ratings, and product additions. A cross-site scripting vulnerability exists in OpenCart versions prior to 4.1.0. An attacker can exploit this vulnerability to modify...

OpenCart 跨站脚本漏洞

OpenCart is an open source e-commerce system by the Chinese OpenCart team. The system provides modules for product reviews, product ratings, and product additions. A cross-site scripting vulnerability exists in OpenCart versions prior to 4.1.0. An attacker can exploit this vulnerability to modify...

OpenCart File Upload Vulnerability

OpenCart is a set of open source e-commerce system from China OpenCart team. The system provides product reviews, product ratings, product additions and other modules. A file upload vulnerability exists in OpenCart version 1.0, which stems from the lack of effective validation of uploaded files b...

CVE-2025-1117

A vulnerability, which was classified as critical, was found in CoinRemitter 0.0.1/0.0.2 on OpenCart. This affects an unknown part. The manipulation of the argument coin leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be...

CVE-2025-1117 CoinRemitter sql injection

A vulnerability, which was classified as critical, was found in CoinRemitter 0.0.1/0.0.2 on OpenCart. This affects an unknown part. The manipulation of the argument coin leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be...

CVE-2025-1117 CoinRemitter sql injection

A vulnerability, which was classified as critical, was found in CoinRemitter 0.0.1/0.0.2 on OpenCart. This affects an unknown part. The manipulation of the argument coin leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be...

CVE-2025-1116

A vulnerability, which was classified as critical, has been found in Dreamvention Live AJAX Search Free up to 1.0.6 on OpenCart. Affected by this issue is the function searchresults/search of the file /?route=extension/livesearch/module/livesearch.searchresults. The manipulation of the argument...

CVE-2025-1116 Dreamvention Live AJAX Search Free live_search.searchresults search sql injection

A vulnerability, which was classified as critical, has been found in Dreamvention Live AJAX Search Free up to 1.0.6 on OpenCart. Affected by this issue is the function searchresults/search of the file /?route=extension/livesearch/module/livesearch.searchresults. The manipulation of the argument...

CVE-2025-1116 Dreamvention Live AJAX Search Free live_search.searchresults search sql injection

A vulnerability, which was classified as critical, has been found in Dreamvention Live AJAX Search Free up to 1.0.6 on OpenCart. Affected by this issue is the function searchresults/search of the file /?route=extension/livesearch/module/livesearch.searchresults. The manipulation of the argument...

CVE-2025-1116

Dreamvention Live AJAX Search Free for OpenCart up to version 1.0.6 is affected by a SQL injection in the searchresults/search endpoint (/?route=extension/live_search/module/live_search.searchresults) via the keyword parameter. Multiple connected sources confirm remote exploitation and public dis...

PT-2025-6019 · Unknown +1 · Coinremitter +1

Name of the Vulnerable Software and Affected Versions: CoinRemitter versions 0.0.1 through 0.0.2 Description: A critical issue was found in CoinRemitter on OpenCart, affecting an unknown part. The manipulation of the coin argument leads to SQL injection. It is possible to initiate the attack...

Dreamvention Live AJAX Search Free 注入漏洞

Dreamvention Live AJAX Search Free is a software developed by Dreamvention's is company. It is a real-time search plug-in for the OpenCart platform designed to provide users with fast and easy search functionality. An injection vulnerability exists in Dreamvention Live AJAX Search Free version...

CoinRemitter Plugin For Opencart 注入漏洞

CoinRemitter Plugin For Opencart is an OpenCart plugin from the individual developers at Coinremitter. An injection vulnerability exists in CoinRemitter Plugin For Opencart version 0.0.1 and 0.0.2, which stems from an incorrect manipulation of the parameter coin that can lead to sql injection...

CVE-2025-0974

A vulnerability was determined in MaxD Lightning Module 4.43/4.44 on OpenCart. This issue affects some unknown processing. Executing a manipulation of the argument liop/md can lead to deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The...

CVE-2025-22335

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rajib.dewan Opencart Product in WP opencart-product-in-wp allows Reflected XSS.This issue affects Opencart Product in WP: from n/a through = 1.0.1...

CVE-2025-0460

A vulnerability, which was classified as critical, was found in Blog Botz for Journal Theme 1.0 on OpenCart. This affects an unknown part of the file /index.php?route=extension/module/blogadd. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the atta...

CVE-2025-0579

A vulnerability was found in Shiprocket Module 3/4 on OpenCart. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php?route=extension/shiprocket/module/restapi of the component REST API Module. The manipulation of the argument x-userna...

CVE-2025-0841

A vulnerability has been found in Aridius XYZ up to 20240927 on OpenCart and classified as critical. This vulnerability affects the function loadMore of the component News. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the publi...

CVE-2024-21514

This affects versions of the package opencart/opencart from 0.0.0. An SQL Injection issue was identified in the Divido payment extension for OpenCart, which is included by default in version 3.0.3.9. As an anonymous unauthenticated user, if the Divido payment module is installed it does not have ...