express-cart (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package express-cart, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (4)

• CVE-2018-12457 — CVSS 8.8 (high): expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header.
• CVE-2018-16483 — CVSS 8.8 (high): A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as…
• CVE-2018-3758 — CVSS 8.8 (high): Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.
• CVE-2020-22403 — CVSS 8.8 (high): Cross Site Request Forgery (CSRF) vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code…