RSS   Podatności dla 'Litecart'   RSS

2022-07-11
 
CVE-2022-27168

CWE-79
 
 
Cross-site scripting vulnerability in LiteCart versions prior to 2.4.2 allows a remote attacker to inject an arbitrary script via unspecified vectors.

 
2020-02-25
 
CVE-2020-9018

CWE-352
 
 
LiteCart through 2.2.1 allows admin/?app=users&doc=edit_user CSRF to add a user.

 
 
CVE-2020-9017

CWE-74
 
 
LiteCart through 2.2.1 allows CSV injection via a customer's profile.

 
2018-08-16
 
CVE-2018-12256

 
 
admin/vqmods.app/vqmods.inc.php in LiteCart before 2.1.3 allows remote authenticated attackers to upload a malicious file (resulting in remote code execution) by using the text/xml or application/xml Content-Type in a public_html/admin/?app=vqmods&doc=vqmods request.

 
2018-05-09
 
CVE-2018-10827

CWE-400
 
 
LiteCart before 2.1.2 allows remote attackers to cause a denial of service (memory consumption) via URIs that do not exist, because public_html/logs/not_found.log grows without bound, and is loaded into memory for each request.

 
2014-10-22
 
CVE-2014-7183

CWE-79
 
 
Multiple cross-site scripting (XSS) vulnerabilities in the search.php in LiteCart 1.1.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) query parameter or (2) QUERY_STRING.

 

Copyright 2024, cxsecurity.com

 

Back to Top