kartatopia records
3 published records for vendor kartatopia.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1
- CWE-352 Cross-Site Request Forgery (CSRF)1
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
3 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
36Monitor | CVE-2019-9769Proof of concept | PilusCart 1.4.1 is vulnerable to index.php?module=users&action=newUser CSRF, leading to the addition of a new user as administrator.kartatopia · piluscart · CWE-352 | High8.8 | — | 2.2% | Mar 14, 2019 |
35Monitor | CVE-2019-16123Proof of concept | In Kartatopia PilusCart 1.4.1, the parameter filename in the file catalog.php is mishandled, leading to ../ Local File Disclosure.kartatopia · piluscart · CWE-22 | High7.5 | — | 16.6% | Sep 8, 2019 |
35Monitor | CVE-2019-25672No exploit | PilusCart 1.4.1 SQL Injection via send Parameterkartatopia · piluscart · CWE-89 | High8.8 | — | 0.3% | Apr 5, 2026 |
- CVE-2019-976936Monitor
PilusCart 1.4.1 is vulnerable to index.php?module=users&action=newUser CSRF, leading to the addition of a new user as administrator.
HighCVSS 8.8Proof of conceptEPSS 2%kartatopia · piluscartMar 14, 2019
- CVE-2019-1612335Monitor
In Kartatopia PilusCart 1.4.1, the parameter filename in the file catalog.php is mishandled, leading to ../ Local File Disclosure.
HighCVSS 7.5Proof of conceptEPSS 16%kartatopia · piluscartSep 8, 2019
- CVE-2019-2567235Monitor
PilusCart 1.4.1 SQL Injection via send Parameter
HighCVSS 8.8No exploitEPSS 0%kartatopia · piluscartApr 5, 2026