CVE-2020-22403
Published Aug 12, 2021Cross Site Request Forgery (CSRF) vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts.
Vendor archive
express-cart_project CVEs
Beta · best-effort4 CVEs tagged to vendor express-cart_project — 0 Critical, 3 High, 1 Medium, 0 Low, 0 Unrated.
CVE-2021-32573
Published May 11, 2021The express-cart package through 1.1.10 for Node.js allows Reflected XSS (for an admin) via a user input field for product options. NOTE: the vendor states that this "would rely o…
CVE-2018-16483
Published Feb 1, 2019A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.
CVE-2018-3758
Published Jun 7, 2018Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.
Showing 1-4 of 4 CVEsPage 1 of 1