Opencart vulnerabilities

Products

• Opencart 47

Newest

• opencart OpenCart through 4.1.0.4 Payment Bypass via Free Checkout Reward Points CVE-2026-119558 2.3 LowOctober 30, 2026
• opencart OpenCart Autocomplete Workflow edit.php cross site scripting CVE-2026-84438 5.1 MediumSeptember 2, 2026
• opencart OpenCart Autocomplete Workflow address.php cross site scripting CVE-2026-84437 5.1 MediumSeptember 2, 2026
• opencart The OpenCart v4.2.0.0 extension installer contains a directory traversal vulnerability CVE-2026-18412 9.1 CriticalAugust 10, 2026
• opencart OpenCart 3.0.3.7 Cross-Site Request Forgery via account/password CVE-2021-47953 5.3 MediumMay 10, 2026
• opencart OpenCart 3.0.3.6 Account Takeover via Cross Site Request Forgery CVE-2021-47946 6.9 MediumMay 10, 2026
• opencart OpenCart 3.0.3.8 Session Fixation via OCSESSID Cookie CVE-2021-47923 9.3 CriticalMay 10, 2026
• opencart OpenCart Extension Installer installer.php path traversal CVE-2026-5331 5.1 MediumApril 2, 2026
• opencart, opencart core +1 more OpenCart Core 4.0.2.3 SQL Injection via search Parameter CVE-2024-58341 8.8 HighMarch 25, 2026
• opencart OpenCart Incomplete Fix CVE-2024-36694 template.php save special elements used in a template engine CVE-2026-3714 5.1 MediumMarch 8, 2026
• opencart OpenCart Single-Use Coupon race condition CVE-2025-15116 6.3 MediumDecember 28, 2025
• opencart OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file... CVE-2025-45893 6.1 MediumJuly 25, 2025
• opencart OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via the blog... CVE-2025-45892 6.1 MediumJuly 25, 2025
• opencart HTML injection vulnerability in OpenCart CVE-2025-1749 Fix available 4.7 MediumFebruary 28, 2025
• opencart HTML injection vulnerability in OpenCart CVE-2025-1748 Fix available 4.7 MediumFebruary 28, 2025
• opencart HTML injection vulnerability in OpenCart CVE-2025-1747 Fix available 4.7 MediumFebruary 28, 2025
• opencart Cross-Site Scripting vulnerability in OpenCart CVE-2025-1746 Fix available 6.1 MediumFebruary 28, 2025
• opencart openCart Server-Side Template Injection (SSTI) vulnerability CVE-2024-36694 Fix available 7.2 HighJuly 17, 2024
• opencart Cross site scripting in opencart CVE-2024-21516 2.1 LowJune 22, 2024
• opencart Arbitrary File Creation in opencart CVE-2024-21519 6.6 MediumJune 22, 2024
• opencart SQL injection in opencart CVE-2024-21514 Public exploit EPSS 19.1% 7.4 HighJune 22, 2024
• opencart Zip slip in opencart CVE-2024-21518 EPSS 14.1% 7.2 HighJune 22, 2024
• opencart Cross site scripting in opencart CVE-2024-21517 2.1 LowJune 22, 2024
• opencart Cross site scripting in opencart CVE-2024-21515 2.1 LowJune 22, 2024
• opencart An issue discovered in OpenCart 4.0.0.0 to 4.0.2.3 allows authenticated backend users having... CVE-2023-47444 8.8 HighNovember 15, 2023
• opencart Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 CVE-2023-2315 Fix available 8.1 HighSeptember 26, 2023
• opencart OpenCart v4.0.2.2 is vulnerable to Brute Force Attack. CVE-2023-40834 9.8 CriticalSeptember 12, 2023
• opencart SQL injection vulnerability in OpenCart v.2.2.00 thru 3.0.3.2 allows a remote attacker to execute... CVE-2020-20491 7.2 HighJune 20, 2023
• opencart OpenCart SQL injection vulnerability CVE-2021-37823 4.9 MediumNovember 3, 2022
• opencart In OpenCart 1.4.7 to 1.5.5.1, implemented anti-traversal code in filemanager.php is ineffective... CVE-2013-1891 Public exploit 6.5 MediumJune 24, 2022
• opencart OpenCart Cross-site Scripting (XSS) in the Subject field of mail. CVE-2020-29470 Public exploit 4.8 MediumDecember 29, 2020
• opencart OpenCart Stored Cross-Site Scripting CVE-2020-29471 Public exploit 4.8 MediumDecember 29, 2020
• opencart OpenCart Cross-Site Request Forgery (CSRF) CVE-2020-28838 3.5 LowDecember 11, 2020
• opencart OpenCart Cross-site Scripting CVE-2020-13980 Disputed 4.8 MediumJune 9, 2020
• opencart Cross-site Scripting in OpenCart CVE-2020-10596 Public exploit 5.4 MediumMarch 17, 2020
• opencart OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the... CVE-2019-15081 Public exploit 4.8 MediumAugust 15, 2019
• opencart OpenCart Cross-Site Request Forgery (CSRF) CVE-2018-13067 8.8 HighJuly 2, 2018
• opencart OpenCart Path Traversal CVE-2018-11495 4.9 MediumMay 26, 2018
• opencart OpenCart Path Traversal CVE-2018-11494 8.0 HighMay 26, 2018
• opencart The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows... CVE-2014-3990 9.8 CriticalMarch 20, 2018
• opencart SQL injection vulnerability in the updateAmazonOrderTracking function in upload/admin/model... CVE-2016-10509 7.2 HighAugust 31, 2017
• opencart Cross-site scripting (XSS) vulnerability in OpenCart before 2.1.0.2 allows remote attackers to... CVE-2015-4671 6.1 MediumJanuary 12, 2016
• opencart OpenCart 1.4.9.3 allows remote attackers to obtain sensitive information via a direct request to... CVE-2011-3763 5.0 MediumSeptember 24, 2011
• opencart Cross-site request forgery (CSRF) vulnerability in index.php in OpenCart 1.4 allows remote... CVE-2010-1610 6.8 MediumApril 29, 2010
• opencart SQL injection vulnerability in index.php in OpenCart 1.3.2 allows remote attackers to execute... CVE-2010-0956 7.5 HighMarch 9, 2010
• opencart Directory traversal vulnerability in index.php in OpenCart 1.1.8 allows remote attackers to read... CVE-2009-1621 Public exploit 5.0 MediumMay 12, 2009
• opencart SQL injection vulnerability in OpenCart 1.1.8 allows remote attackers to execute arbitrary SQL... CVE-2009-1027 7.5 HighMarch 20, 2009