CVE-2013-0118
CVE-2013-0118 is a medium-severity vulnerability in Cs-cart with a CVSS 2.0 base score of 5.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-16.
Key facts
- Severity: Medium (CVSS 2.0 base score 5.0)
- EPSS exploit prediction: 2% (75th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-16
- Affected product: Cs-cart
- Published:
- Last modified:
Description
CS-Cart before 3.0.6, when PayPal Standard Payments is configured, allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self.
Frequently asked questions
- What is CVE-2013-0118?
- CS-Cart before 3.0.6, when PayPal Standard Payments is configured, allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self.
- How severe is CVE-2013-0118?
- CVE-2013-0118 has a CVSS 2.0 base score of 5.0, rated medium severity.
- Is CVE-2013-0118 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (75th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2013-0118?
- CVE-2013-0118 primarily affects Cs-cart. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2013-0118?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2013-0118 published?
- CVE-2013-0118 was published on 2013-02-24 and last updated on 2026-06-16.
References
Affected products (5)
- cpe:2.3:a:cs-cart:cs-cart:*:*:*:*:*:*:*:*
- cpe:2.3:a:cs-cart:cs-cart:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:cs-cart:cs-cart:3.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:cs-cart:cs-cart:3.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:cs-cart:cs-cart:3.0.4:*:*:*:*:*:*:*
More vulnerabilities in Cs-cart
- CVE-2017-2138 — High (CVSS 8.8): Cross-site request forgery (CSRF) vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3),…
- CVE-2016-4862 — High (CVSS 8.8): Twigmo bundled with CS-Cart 4.3.9 and earlier and Twigmo bundled with CS-Cart Multi-Vendor 4.3.9 and earlier allow…
- CVE-2025-50850 — High (CVSS 8.6): An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such…
- CVE-2009-4891 — High (CVSS 7.5): SQL injection vulnerability in index.php in CS-Cart 2.0.0 Beta 3 allows remote attackers to execute arbitrary SQL…
- CVE-2008-6394 — High (CVSS 7.5): SQL injection vulnerability in core/user.php in CS-Cart 1.3.5 and earlier allows remote attackers to execute arbitrary…
- CVE-2007-0230 — High (CVSS 7.5): PHP remote file inclusion vulnerability in install.php in CS-Cart 1.3.3 allows remote attackers to execute arbitrary…
Other CWE-16 vulnerabilities
- CVE-2013-4316 — Critical (CVSS 10.0): Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack…
- CVE-2013-1221 — Critical (CVSS 10.0): The Tomcat Web Management feature in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 does not…
- CVE-2011-4501 — Critical (CVSS 10.0): The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg,…
- CVE-2010-4586 — Critical (CVSS 10.0): The default configuration of Opera before 11.00 enables WebSockets functionality, which has unspecified impact and…
- CVE-2010-2977 — Critical (CVSS 10.0): Cisco Unified Wireless Network (UWN) Solution 7.x before 7.0.98.0 does not properly implement TLS and SSL, which has…
- CVE-2010-2276 — Critical (CVSS 10.0): The default configuration of the build process in Dojo 0.4.x before 0.4.4, 1.0.x before 1.0.3, 1.1.x before 1.1.2,…