Express-cart (Express-cart Project) - vulnerabilities (CVEs)

4 CVEs, 0 in the last 30 days, 15 known versions, newest CVE from 2021-08-12. Vendor: Express-cart Project.

CVEs of Express-cart

• CVE-2020-22403 - CVSS 8.8 (high), 2021-08-12: Cross Site Request Forgery (CSRF) vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other…
• CVE-2021-32573 - CVSS 4.8 (medium), 2021-05-11: The express-cart package through 1.1.10 for Node.js allows Reflected XSS (for an admin) via a user input field for product options. NOTE: the vendor states…
• CVE-2018-16483 - CVSS 8.8 (high), 2019-02-01: A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.
• CVE-2018-3758 - CVSS 8.8 (high), 2018-06-07: Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.