Skip to content

OpenCart exploits

OpenCart Core 4.0.2.3 – ‘search’ SQLi

High

OpenCart v3.x Newsletter Module – Blind SQLi

High

opencart 3.0.3.8 – Sessjion Injection

High

Opencart 3 Extension TMD Vendor System – Blind SQL Injection

Critical

OpenCart 3.0.3.7 – ‘Change Password’ Cross-Site Request Forgery (CSRF)

High

OpenCart 3.0.36 – ATO via Cross Site Request Forgery

High

OpenCart 3.0.3.6 – Cross Site Request Forgery

High

OpenCart 3.0.3.6 – ‘Profile Image’ Stored Cross-Site Scripting (Authenticated)

CVE-2020-29471 · High

OpenCart 3.0.3.6 – ‘subject’ Stored Cross-Site Scripting

CVE-2020-29470 · High

OpenCart Theme Journal 3.1.0 – Sensitive Data Exposure

CVE-2020-15478 · High

OpenCart 3.0.3.2 – Stored Cross Site Scripting (Authenticated)

CVE-2020-10596 · High

Opencart 3.x – Cross-Site Scripting

CVE-2019-15081 · High

Opencart 3.0.3.2 – ‘extension/feed/google_base’ Denial of Service (PoC)

High

Joomla! Component jCart for OpenCart 2.3.0.2 – Cross-Site Request Forgery

High

Joomla! Component jCart for OpenCart 2.0 – ‘product_id’ SQL Injection

Critical

OpenCart 2.1.0.2 < 2.2.0.0 - json_decode Function Remote Code Execution

Critical

OpenCart 1.5.6.1 – ‘openbay’ Multiple SQL Injections

OSVDB-104980 · Critical

OpenCart – Cross-Site Request Forgery (Change User Password)

OSVDB-92311 · High

OpenCart 1.5.5.1 – ‘FileManager.php’ Directory Traversal Arbitrary File Access

OSVDB-91500;CVE-2013-1891 · High

opencart 1.5.2.1 – Multiple Vulnerabilities

OSVDB-81243;OSVDB-81242;OSVDB-81241;OSVDB-81240;OSVDB-81239;OSVDB-81238 · High

OpenCart 1.5.1.2 – Blind SQL Injection

OSVDB-86068 · Critical

OpenCart 1.4.9 – Multiple Local File Inclusions

High

Opencart 1.4.9.1 – Arbitrary File Upload

Critical

OpenCart 1.3.2 – ‘page’ SQL Injection

Critical

Opencart 1.1.8 – ‘route’ Local File Inclusion

OSVDB-54424;CVE-2009-1621 · High