Skip to content
Noroxi

Opencart records

39 published records for vendor opencart.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
3
With a fix record
5.1%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 22
  6. 23
  7. 24
  8. 25
  9. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

39 records
  • CVE-2014-3990
    41Plan

    The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side reque

    CriticalCVSS 9.8No exploitEPSS 6%

    opencart · opencartMar 20, 2018

  • CVE-2023-40834
    39Monitor

    OpenCart CMS v4.0.2.2 was discovered to lack a protective mechanism on its login page against excessive login attempts, allowing unauthentic

    CriticalCVSS 9.8No exploitEPSS 1%

    opencart · opencartSep 12, 2023

  • CVE-2024-21514
    38Monitor

    This affects versions of the package opencart/opencart from 0.0.0.

    HighCVSS 8.1Proof of conceptEPSS 19%

    opencart · opencartJun 22, 2024

  • CVE-2023-47444
    36Monitor

    An issue discovered in OpenCart 4.0.0.0 to 4.0.2.3 allows authenticated backend users having common/security write privilege can write arbit

    HighCVSS 8.8No exploitEPSS 1%

    opencart · opencartNov 15, 2023

  • CVE-2023-2315
    35Monitor

    Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2

    HighCVSS 8.8No exploitEPSS 1%

    opencart · opencartSep 27, 2023

  • CVE-2018-13067
    35Monitor

    /upload/catalog/controller/account/password.php in OpenCart through 3.0.2.0 has CSRF via the index.php?route=account/password URI to change

    HighCVSS 8.8No exploitEPSS 0%

    opencart · opencartJul 2, 2018

  • CVE-2024-58341
    35Monitor

    OpenCart Core 4.0.2.3 SQL Injection via search Parameter

    HighCVSS 8.8No exploitEPSS 0%

    opencart · opencartMar 25, 2026

  • CVE-2018-11494
    33Monitor

    The "program extension upload" feature in OpenCart through 3.0.2.0 has a six-step process (upload, install, unzip, move, xml, remove) that a

    HighCVSS 8.0No exploitEPSS 2%

    opencart · opencartMay 26, 2018

  • CVE-2024-21518
    32Monitor

    This affects versions of the package opencart/opencart from 4.0.0.0.

    HighCVSS 7.2No exploitEPSS 14%

    opencart · opencartJun 22, 2024

  • CVE-2009-1027
    31Monitor

    SQL injection vulnerability in OpenCart 1.1.8 allows remote attackers to execute arbitrary SQL commands via the order parameter.

    HighCVSS 7.5No exploitEPSS 1%

    opencart · opencartMar 19, 2009

  • CVE-2010-0956
    30Monitor

    SQL injection vulnerability in index.php in OpenCart 1.3.2 allows remote attackers to execute arbitrary SQL commands via the page parameter.

    HighCVSS 7.5No exploitEPSS 1%

    opencart · opencartMar 10, 2010

  • CVE-2013-1891
    28Monitor

    In OpenCart 1.4.7 to 1.5.5.1, implemented anti-traversal code in filemanager.php is ineffective and can be bypassed.

    MediumCVSS 6.5Proof of conceptEPSS 6%

    opencart · opencartJun 24, 2022

  • CVE-2016-10509
    28Monitor

    SQL injection vulnerability in the updateAmazonOrderTracking function in upload/admin/model/openbay/amazon.php in OpenCart before version 2.

    HighCVSS 7.2No exploitEPSS 1%

    opencart · opencartAug 31, 2017

  • CVE-2020-20491
    28Monitor

    SQL injection vulnerability in OpenCart v.2.2.00 thru 3.0.3.2 allows a remote attacker to execute arbitrary code via the Fba plugin function

    HighCVSS 7.2No exploitEPSS 1%

    opencart · opencartJun 20, 2023

  • CVE-2024-36694
    28Monitor

    OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the Theme Editor Function.

    HighCVSS 7.2No exploitEPSS 0%

    opencart · opencartDec 18, 2024

  • CVE-2024-21519
    28Monitor

    This affects versions of the package opencart/opencart from 4.0.0.0.

    HighCVSS 7.2No exploitEPSS 0%

    opencart · opencartJun 22, 2024

  • CVE-2010-1610
    27Monitor

    Cross-site request forgery (CSRF) vulnerability in index.php in OpenCart 1.4 allows remote attackers to hijack the authentication of an appl

    MediumCVSS 6.8No exploitEPSS 0%

    opencart · opencartApr 29, 2010

  • CVE-2015-4671
    24Monitor

    Cross-site scripting (XSS) vulnerability in OpenCart before 2.1.0.2 allows remote attackers to inject arbitrary web script or HTML via the z

    MediumCVSS 6.1No exploitEPSS 1%

    opencart · opencartJan 12, 2016

  • CVE-2025-45893
    24Monitor

    OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts.

    MediumCVSS 6.1No exploitEPSS 0%

    opencart · opencartJul 25, 2025

  • CVE-2025-45892
    24Monitor

    OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via the blog editor.

    MediumCVSS 6.1No exploitEPSS 0%

    opencart · opencartJul 25, 2025

  • CVE-2025-1746
    24Monitor

    Cross-Site Scripting vulnerability in OpenCart

    MediumCVSS 6.1No exploitEPSS 0%

    opencart · opencartFeb 28, 2025

  • CVE-2009-1621
    22Monitor

    Directory traversal vulnerability in index.php in OpenCart 1.1.8 allows remote attackers to read arbitrary files via a ..

    MediumCVSS 5.0Proof of conceptEPSS 6%

    opencart · opencartMay 12, 2009

  • CVE-2020-10596
    22Monitor

    OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section.

    MediumCVSS 5.4Proof of conceptEPSS 2%

    opencart · opencartMar 17, 2020

  • CVE-2019-15081
    20Monitor

    OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing feature of the Categor

    MediumCVSS 4.8Proof of conceptEPSS 1%

    opencart · opencartAug 15, 2019

  • CVE-2020-29470
    20Monitor

    OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail.

    MediumCVSS 4.8Proof of conceptEPSS 1%

    opencart · opencartDec 29, 2020