Express-cart Project Express-cart — known CVE vulnerabilities

Every CVE whose affected-product data names Express-cart Project Express-cart, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (4)

• CVE-2018-16483 — CVSS 8.8 (high): A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as…
• CVE-2018-3758 — CVSS 8.8 (high): Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.
• CVE-2020-22403 — CVSS 8.8 (high): Cross Site Request Forgery (CSRF) vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code…
• CVE-2021-32573 — CVSS 4.8 (medium): The express-cart package through 1.1.10 for Node.js allows Reflected XSS (for an admin) via a user input field for product options. NOTE…