CVE-2018-3758

Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.

Score

CVSS 3.1 8.8 High

Status

Modified - support@hackerone.com

Published

2018-06-07

Last modified

2024-09-17

Weaknesses

CWE-22, CWE-434

Affected products

• Express-cart (Express-cart Project)
• Express-cart (Hackerone)

References

• https://hackerone.com/reports/343726