{"id":"CVE-2014-3990","title":"The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side reque","published":"2018-03-20T17:29:00.703Z","updated":"2026-06-16T20:09:15.403Z","severity":"critical","cvssScore":9.8,"epss":0.06604,"epssPct":0.93941,"kev":false,"maturity":"none","actionScore":41,"primaryVendor":"opencart","primaryProduct":"opencart","cweId":"CWE-611","fixAvailable":false,"tags":["pre-auth","rce","ssrf","xxe","remote","no-ui"],"epssDelta7":-0.0026,"summary":"The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side request forgery (SSRF) attacks or possibly conduct XML External Entity (XXE) attacks and execute arbitrary code via a crafted serialized PHP object, related to the quantity parameter in an update request.","cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.0","cvssSource":"nvd-primary","cweName":"Improper Restriction of XML External Entity Reference","kevAdded":null,"kevDue":null,"kevRansomware":null,"source":"nvd","cna":"mitre","ssvc":null,"sources":{"cna":"2024-08-06T11:04:26.934Z","epss":"2026-11-12","cna_seen":"2026-09-29T10:47:37.660Z"},"cvssCna":null,"hasPatchRef":true,"credits":[],"counts":{"exploitdb":0,"metasploit":0,"nuclei":0,"githubPoc":0},"products":[{"vendor":"opencart","product":"opencart","cpe":"cpe:2.3:a:opencart:opencart"}],"references":[{"url":"http://www.securityfocus.com/bid/68529","tags":"Third Party Advisory,VDB Entry"},{"url":"https://github.com/opencart-ce/opencart-ce/commit/c2aafc823bd85876f5e888f8ebc421069a5e076f","tags":"Issue Tracking,Patch,Third Party Advisory"}],"exploits":[],"analysis":null,"affectedVersions":[{"vendor":"opencart","product":"opencart","version":"*","vsi":null,"vse":null,"vei":"1.5.6.4","vee":null}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}