Search criteria

24 vulnerabilities found for cs-cart_multivendor by cs-cart

FKIE_CVE-2023-26691

Vulnerability from fkie_nvd - Published: 2024-09-25 01:15 - Updated: 2025-04-24 14:16
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via crafted zip file when installing a new add-on.
References
cve@mitre.orghttps://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26691%20-%20Zip%20Slip%20in%20CS-Cart%20MultiVendor%204.16.1Exploit, Third Party Advisory
cve@mitre.orghttps://www.cs-cart.com/multivendor.htmlProduct
Impacted products
Vendor Product Version
cs-cart cs-cart_multivendor 4.16.1
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.16.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E65BAFFF-E121-47B3-B1BD-1283040A39F0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via crafted zip file when installing a new add-on."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de Directory Traversal en CS-Cart MultiVendor 4.16.1 permite a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de un archivo zip creado al instalar un nuevo complemento."
    }
  ],
  "id": "CVE-2023-26691",
  "lastModified": "2025-04-24T14:16:34.050",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-09-25T01:15:34.057",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26691%20-%20Zip%20Slip%20in%20CS-Cart%20MultiVendor%204.16.1"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Product"
      ],
      "url": "https://www.cs-cart.com/multivendor.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2023-26687

Vulnerability from fkie_nvd - Published: 2024-09-25 01:15 - Updated: 2025-04-24 14:17
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to obtain sensitive information via the product_data parameter in the PDF Add-on.
References
cve@mitre.orghttps://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26687%20-%20Local%20File%20Inclusion%20vulnerability%20in%20CS-Cart%20MultiVendorExploit, Third Party Advisory
Impacted products
Vendor Product Version
cs-cart cs-cart_multivendor 4.16.1
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.16.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E65BAFFF-E121-47B3-B1BD-1283040A39F0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to obtain sensitive information via the product_data parameter in the PDF Add-on."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de Directory Traversal en CS-Cart MultiVendor 4.16.1 permite a atacantes remotos obtener informaci\u00f3n confidencial a trav\u00e9s del par\u00e1metro product_data en el complemento PDF."
    }
  ],
  "id": "CVE-2023-26687",
  "lastModified": "2025-04-24T14:17:24.510",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-09-25T01:15:33.837",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26687%20-%20Local%20File%20Inclusion%20vulnerability%20in%20CS-Cart%20MultiVendor"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2023-26690

Vulnerability from fkie_nvd - Published: 2024-09-25 01:15 - Updated: 2025-04-24 14:16
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via File Manager/Editor component in the vendor or admin menu.
References
cve@mitre.orghttps://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26690%20-%20%20File%20Upload%20vulnerability%20in%20File%20Manager%20of%20CS-Cart%20MultiVendor%204.16.1Exploit, Third Party Advisory
cve@mitre.orghttps://www.cs-cart.com/multivendor.htmlProduct
Impacted products
Vendor Product Version
cs-cart cs-cart_multivendor 4.16.1
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.16.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E65BAFFF-E121-47B3-B1BD-1283040A39F0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via File Manager/Editor component in the vendor or admin menu."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de carga de archivos en CS-Cart MultiVendor 4.16.1 permite a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s del componente Administrador/Editor de archivos en el men\u00fa de administraci\u00f3n o del proveedor."
    }
  ],
  "id": "CVE-2023-26690",
  "lastModified": "2025-04-24T14:16:49.820",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-09-25T01:15:33.997",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26690%20-%20%20File%20Upload%20vulnerability%20in%20File%20Manager%20of%20CS-Cart%20MultiVendor%204.16.1"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Product"
      ],
      "url": "https://www.cs-cart.com/multivendor.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2023-26689

Vulnerability from fkie_nvd - Published: 2024-09-25 01:15 - Updated: 2025-04-24 14:16
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request.
References
cve@mitre.orghttps://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26689%20-%20Insufficient%20Authorization%20for%20API%20key%20creation%20in%20CS-Cart%20MultiVendor%204.16.1Exploit, Third Party Advisory
Impacted products
Vendor Product Version
cs-cart cs-cart_multivendor 4.16.1
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.16.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E65BAFFF-E121-47B3-B1BD-1283040A39F0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request."
    },
    {
      "lang": "es",
      "value": "Un problema descubierto en CS-Cart MultiVendor 4.16.1 permite a los atacantes alterar perfiles de cuentas de usuario arbitrarias a trav\u00e9s de solicitudes de publicaciones manipuladas."
    }
  ],
  "id": "CVE-2023-26689",
  "lastModified": "2025-04-24T14:16:54.087",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-09-25T01:15:33.943",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26689%20-%20Insufficient%20Authorization%20for%20API%20key%20creation%20in%20CS-Cart%20MultiVendor%204.16.1"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-286"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2023-26686

Vulnerability from fkie_nvd - Published: 2024-09-25 01:15 - Updated: 2025-04-24 14:17
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the image upload feature when customizing a shop.
References
cve@mitre.orghttps://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26686%20-%20File%20Upload%20vulnerability%20in%20product%20image%20of%20CS-Cart%20MultiVendor%204.16.1Exploit, Third Party Advisory
cve@mitre.orghttps://www.cs-cart.com/multivendor.htmlProduct
Impacted products
Vendor Product Version
cs-cart cs-cart_multivendor 4.16.1
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.16.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E65BAFFF-E121-47B3-B1BD-1283040A39F0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the image upload feature when customizing a shop."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de carga de archivos en CS-Cart MultiVendor 4.16.1 permite a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de la funci\u00f3n de carga de im\u00e1genes al personalizar una tienda."
    }
  ],
  "id": "CVE-2023-26686",
  "lastModified": "2025-04-24T14:17:30.370",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-09-25T01:15:33.760",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26686%20-%20File%20Upload%20vulnerability%20in%20product%20image%20of%20CS-Cart%20MultiVendor%204.16.1"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Product"
      ],
      "url": "https://www.cs-cart.com/multivendor.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2023-26688

Vulnerability from fkie_nvd - Published: 2024-09-25 01:15 - Updated: 2025-04-24 14:16
Severity ?
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
Cross Site Scripting (XSS) vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the product_data parameter of add/edit product in the administration interface.
References
cve@mitre.orghttps://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26688%20-%20Cross%20Site%20Scripting%20%28XSS%29%20vulnerability%20in%20CS-Cart%20MultiVendor%204.16.1Exploit, Third Party Advisory
cve@mitre.orghttps://www.cs-cart.com/multivendor.htmlProduct
Impacted products
Vendor Product Version
cs-cart cs-cart_multivendor 4.16.1
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.16.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E65BAFFF-E121-47B3-B1BD-1283040A39F0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross Site Scripting (XSS) vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the product_data parameter of add/edit product in the administration interface."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de Cross Site Scripting (XSS) en CS-Cart MultiVendor 4.16.1 permite a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s del par\u00e1metro product_data de agregar/editar producto en la interfaz de administraci\u00f3n."
    }
  ],
  "id": "CVE-2023-26688",
  "lastModified": "2025-04-24T14:16:58.023",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-09-25T01:15:33.887",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26688%20-%20Cross%20Site%20Scripting%20%28XSS%29%20vulnerability%20in%20CS-Cart%20MultiVendor%204.16.1"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Product"
      ],
      "url": "https://www.cs-cart.com/multivendor.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2017-10886

Vulnerability from fkie_nvd - Published: 2017-11-17 14:29 - Updated: 2025-04-20 01:37
Severity ?
5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
Cross-site scripting vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
References
vultures@jpcert.or.jphttp://tips.cs-cart.jp/fix-jvn-29602086.htmlVendor Advisory
vultures@jpcert.or.jphttps://jvn.jp/en/jp/JVN29602086/index.htmlThird Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://tips.cs-cart.jp/fix-jvn-29602086.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://jvn.jp/en/jp/JVN29602086/index.htmlThird Party Advisory, VDB Entry
Impacted products
Vendor Product Version
cs-cart cs-cart 4.0.1
cs-cart cs-cart 4.0.2
cs-cart cs-cart 4.0.3
cs-cart cs-cart 4.1.1
cs-cart cs-cart 4.1.2
cs-cart cs-cart 4.1.3
cs-cart cs-cart 4.1.4
cs-cart cs-cart 4.2.1
cs-cart cs-cart 4.2.2
cs-cart cs-cart 4.2.3
cs-cart cs-cart 4.2.4
cs-cart cs-cart 4.3.1
cs-cart cs-cart 4.3.2
cs-cart cs-cart 4.3.3
cs-cart cs-cart 4.3.4
cs-cart cs-cart 4.3.5
cs-cart cs-cart 4.3.6
cs-cart cs-cart 4.3.7
cs-cart cs-cart 4.3.8
cs-cart cs-cart 4.3.9
cs-cart cs-cart 4.3.10
cs-cart cs-cart_multivendor 4.0.1
cs-cart cs-cart_multivendor 4.0.2
cs-cart cs-cart_multivendor 4.0.3
cs-cart cs-cart_multivendor 4.1.1
cs-cart cs-cart_multivendor 4.1.2
cs-cart cs-cart_multivendor 4.1.3
cs-cart cs-cart_multivendor 4.1.4
cs-cart cs-cart_multivendor 4.2.1
cs-cart cs-cart_multivendor 4.2.2
cs-cart cs-cart_multivendor 4.2.3
cs-cart cs-cart_multivendor 4.2.4
cs-cart cs-cart_multivendor 4.3.1
cs-cart cs-cart_multivendor 4.3.2
cs-cart cs-cart_multivendor 4.3.3
cs-cart cs-cart_multivendor 4.3.4
cs-cart cs-cart_multivendor 4.3.5
cs-cart cs-cart_multivendor 4.3.6
cs-cart cs-cart_multivendor 4.3.7
cs-cart cs-cart_multivendor 4.3.8
cs-cart cs-cart_multivendor 4.3.9
cs-cart cs-cart_multivendor 4.3.10
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart:4.0.1:*:*:ja:*:*:*:*",
              "matchCriteriaId": "7CEDDB5F-0042-4F91-A374-72F6EA9FE8C5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart:4.0.2:*:*:ja:*:*:*:*",
              "matchCriteriaId": "09888B17-F813-4B09-971A-5EE64C84B223",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart:4.0.3:*:*:ja:*:*:*:*",
              "matchCriteriaId": "A4586C46-0266-4D02-A218-11E9B6C75258",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart:4.1.1:*:*:ja:*:*:*:*",
              "matchCriteriaId": "1795D3A8-F3B7-4B00-8221-62F597888DE4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart:4.1.2:*:*:ja:*:*:*:*",
              "matchCriteriaId": "060D0460-2ECD-41E5-934F-EDC39D75AF28",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart:4.1.3:*:*:ja:*:*:*:*",
              "matchCriteriaId": "34F92804-A076-4877-A35A-3C6E9ABCC60D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart:4.1.4:*:*:ja:*:*:*:*",
              "matchCriteriaId": "5689776B-779D-4C83-B837-FC97F53A3F6B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart:4.2.1:*:*:ja:*:*:*:*",
              "matchCriteriaId": "36C1D456-0A84-4A7A-9CDF-CC25013EA2D0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart:4.2.2:*:*:ja:*:*:*:*",
              "matchCriteriaId": "215F550E-3946-4FC1-A53D-2159FB085C42",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart:4.2.3:*:*:ja:*:*:*:*",
              "matchCriteriaId": "DEBEC0F2-04BC-4EDC-B406-8566EBA6BFC7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart:4.2.4:*:*:ja:*:*:*:*",
              "matchCriteriaId": "6696CFF2-8CA3-476C-93C4-26DD2DD03EF7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart:4.3.1:*:*:ja:*:*:*:*",
              "matchCriteriaId": "1AAFC419-F733-4513-8C91-09752D8D59F1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart:4.3.2:*:*:ja:*:*:*:*",
              "matchCriteriaId": "42F2E657-E293-4375-A9DA-10427E805A64",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart:4.3.3:*:*:ja:*:*:*:*",
              "matchCriteriaId": "01132E65-36E4-46BF-92B8-8C650A809C59",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart:4.3.4:*:*:ja:*:*:*:*",
              "matchCriteriaId": "7B7A9A8F-7429-44C3-92DA-A7FE24731F9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart:4.3.5:*:*:ja:*:*:*:*",
              "matchCriteriaId": "AC17365C-07EB-468F-9645-C9F17BE39129",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart:4.3.6:*:*:ja:*:*:*:*",
              "matchCriteriaId": "44A94CAE-30F6-414E-806B-721FE65AFFCA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart:4.3.7:*:*:ja:*:*:*:*",
              "matchCriteriaId": "BAA8F0F8-3EB4-4D5E-88E1-F92B8A36977F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart:4.3.8:*:*:ja:*:*:*:*",
              "matchCriteriaId": "00CAB998-2FF9-4352-90ED-A6102BFA0223",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart:4.3.9:*:*:ja:*:*:*:*",
              "matchCriteriaId": "0E0F42A0-15F9-4587-A608-52D9F9EB18D0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart:4.3.10:*:*:ja:*:*:*:*",
              "matchCriteriaId": "BA6DD97F-4315-4483-9540-868E4EF479A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.0.1:*:*:ja:*:*:*:*",
              "matchCriteriaId": "5ADC7033-B392-46DB-B04B-2B7AB514AFA2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.0.2:*:*:ja:*:*:*:*",
              "matchCriteriaId": "D2531207-2B53-4CEF-9724-A3D958DC38D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.0.3:*:*:ja:*:*:*:*",
              "matchCriteriaId": "BDC2FD45-31E7-4838-85A9-3C184DDA68C8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.1.1:*:*:ja:*:*:*:*",
              "matchCriteriaId": "0B3B4C1C-B63E-451D-BC9A-CB45C3A5A4FC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.1.2:*:*:ja:*:*:*:*",
              "matchCriteriaId": "03A50D9D-4321-48C7-B362-D7D02768E30C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.1.3:*:*:ja:*:*:*:*",
              "matchCriteriaId": "178E2618-9FED-452F-B379-36D50D544BC4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.1.4:*:*:ja:*:*:*:*",
              "matchCriteriaId": "2C822C02-3E28-4412-803D-10F2D5AC4D5D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.2.1:*:*:ja:*:*:*:*",
              "matchCriteriaId": "5B43CD84-D885-4006-BADA-7E1A3012608C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.2.2:*:*:ja:*:*:*:*",
              "matchCriteriaId": "CD843B2F-A3D5-49A5-B9F0-B8FC146931AF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.2.3:*:*:ja:*:*:*:*",
              "matchCriteriaId": "01C42531-506B-41FF-ADD8-BFE4C492E5D0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.2.4:*:*:ja:*:*:*:*",
              "matchCriteriaId": "3BE29145-9836-4A10-AF2D-BB1EE63820C7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.3.1:*:*:ja:*:*:*:*",
              "matchCriteriaId": "8F33ECEC-3011-4131-AE8F-E44DF85F33ED",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.3.2:*:*:ja:*:*:*:*",
              "matchCriteriaId": "4C2FEE8A-DB91-43E6-9DC1-AB78DE23FF81",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.3.3:*:*:ja:*:*:*:*",
              "matchCriteriaId": "FD83A201-9C79-47BA-BA15-145A46FEEBEF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.3.4:*:*:ja:*:*:*:*",
              "matchCriteriaId": "4A03FAC1-4E22-4344-95E1-87A409C98507",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.3.5:*:*:ja:*:*:*:*",
              "matchCriteriaId": "1CC2EBD9-05B5-402C-B650-33BB86FC6043",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.3.6:*:*:ja:*:*:*:*",
              "matchCriteriaId": "1D9545E8-20E6-46E1-BBDB-662D07DB1E4B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.3.7:*:*:ja:*:*:*:*",
              "matchCriteriaId": "637065FC-883A-4E51-94B5-8F38F0574BCC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.3.8:*:*:ja:*:*:*:*",
              "matchCriteriaId": "5EBCC962-D3B4-4588-87EA-988CBD8EE7FD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.3.9:*:*:ja:*:*:*:*",
              "matchCriteriaId": "39E7A002-9015-4D75-AF02-21964DE6C0EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:4.3.10:*:*:ja:*:*:*:*",
              "matchCriteriaId": "14591AE4-58B9-4F71-BA5E-A1C897979A35",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows an attacker to inject arbitrary web script or HTML via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Cross-Site Scripting (XSS) en CS-Cart Japanese Edition v4.3.10 y versiones anteriores (excepto v2 y v3) y CS-Cart Multivendor Japanese Edition v4.3.10 y versiones anteriores (excepto v2 y v3) que permite que un atacante inyecte scripts web o HTML arbitrarios mediante vectores no especificados."
    }
  ],
  "id": "CVE-2017-10886",
  "lastModified": "2025-04-20T01:37:25.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-11-17T14:29:00.247",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://tips.cs-cart.jp/fix-jvn-29602086.html"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://jvn.jp/en/jp/JVN29602086/index.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://tips.cs-cart.jp/fix-jvn-29602086.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://jvn.jp/en/jp/JVN29602086/index.html"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2017-2138

Vulnerability from fkie_nvd - Published: 2017-08-02 16:29 - Updated: 2025-04-20 01:37
Severity ?
8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
Cross-site request forgery (CSRF) vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows remote attackers to hijack the authentication of administrators via unspecified vectors.
References
vultures@jpcert.or.jphttp://tips.cs-cart.jp/fix-csrf-20170406.htmlVendor Advisory
vultures@jpcert.or.jphttps://jvn.jp/en/jp/JVN87770873/index.htmlThird Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://tips.cs-cart.jp/fix-csrf-20170406.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://jvn.jp/en/jp/JVN87770873/index.htmlThird Party Advisory, VDB Entry
Impacted products
Vendor Product Version
cs-cart cs-cart *
cs-cart cs-cart_multivendor *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart:*:*:*:*:japanese:*:*:*",
              "matchCriteriaId": "E8652FFE-26AB-4CEC-8411-41932837AA7D",
              "versionEndIncluding": "4.3.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cs-cart:cs-cart_multivendor:*:*:*:*:japanese:*:*:*",
              "matchCriteriaId": "C81B130D-46A0-4B66-9A20-BDF9FFE97E56",
              "versionEndIncluding": "4.3.10",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site request forgery (CSRF) vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows remote attackers to hijack the authentication of administrators via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Se ha encontrado una vulnerabilidad de tipo cross-site request forgery (CSRF) en CS-Cart Japanese Edition v4.3.10 y versiones anteriores (excepto v2 y v3); y CS-Cart Multivendor Japanese Edition v4.3.10 y versiones anteriores (excepto v2 y v3). Esta vulnerabilidad permite que los atacantes puedan apropiarse de la autenticaci\u00f3n de los administradores utilizando vectores no especificados."
    }
  ],
  "id": "CVE-2017-2138",
  "lastModified": "2025-04-20T01:37:25.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-08-02T16:29:00.283",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://tips.cs-cart.jp/fix-csrf-20170406.html"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://jvn.jp/en/jp/JVN87770873/index.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://tips.cs-cart.jp/fix-csrf-20170406.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://jvn.jp/en/jp/JVN87770873/index.html"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2023-26689 (GCVE-0-2023-26689)

Vulnerability from cvelistv5 – Published: 2024-09-24 00:00 – Updated: 2024-09-24 18:58
VLAI?
Summary
An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request.
Severity ?
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:cs-cart:cs-cart_multivendor:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cs-cart_multivendor",
            "vendor": "cs-cart",
            "versions": [
              {
                "status": "affected",
                "version": "4.16.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-26689",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T18:57:25.887710Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-286",
                "description": "CWE-286 Incorrect User Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T18:58:26.643Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-24T18:02:26.383567",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26689%20-%20Insufficient%20Authorization%20for%20API%20key%20creation%20in%20CS-Cart%20MultiVendor%204.16.1"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-26689",
    "datePublished": "2024-09-24T00:00:00",
    "dateReserved": "2023-02-27T00:00:00",
    "dateUpdated": "2024-09-24T18:58:26.643Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-26688 (GCVE-0-2023-26688)

Vulnerability from cvelistv5 – Published: 2024-09-24 00:00 – Updated: 2024-09-24 17:23
VLAI?
Summary
Cross Site Scripting (XSS) vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the product_data parameter of add/edit product in the administration interface.
Severity ?
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:cs-cart:cs-cart_multivendor:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cs-cart_multivendor",
            "vendor": "cs-cart",
            "versions": [
              {
                "status": "affected",
                "version": "4.16.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-26688",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T17:09:46.910563Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T17:23:13.212Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross Site Scripting (XSS) vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the product_data parameter of add/edit product in the administration interface."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-24T15:21:07.397095",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.cs-cart.com/multivendor.html"
        },
        {
          "url": "https://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26688%20-%20Cross%20Site%20Scripting%20%28XSS%29%20vulnerability%20in%20CS-Cart%20MultiVendor%204.16.1"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-26688",
    "datePublished": "2024-09-24T00:00:00",
    "dateReserved": "2023-02-27T00:00:00",
    "dateUpdated": "2024-09-24T17:23:13.212Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-26691 (GCVE-0-2023-26691)

Vulnerability from cvelistv5 – Published: 2024-09-24 00:00 – Updated: 2024-09-24 18:24
VLAI?
Summary
Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via crafted zip file when installing a new add-on.
Severity ?
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:cs-cart:cs-cart_multivendor:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cs-cart_multivendor",
            "vendor": "cs-cart",
            "versions": [
              {
                "status": "affected",
                "version": "4.16.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-26691",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T18:23:26.873104Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T18:24:14.319Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via crafted zip file when installing a new add-on."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-24T17:52:35.442005",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.cs-cart.com/multivendor.html"
        },
        {
          "url": "https://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26691%20-%20Zip%20Slip%20in%20CS-Cart%20MultiVendor%204.16.1"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-26691",
    "datePublished": "2024-09-24T00:00:00",
    "dateReserved": "2023-02-27T00:00:00",
    "dateUpdated": "2024-09-24T18:24:14.319Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-26690 (GCVE-0-2023-26690)

Vulnerability from cvelistv5 – Published: 2024-09-24 00:00 – Updated: 2024-09-24 18:21
VLAI?
Summary
File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via File Manager/Editor component in the vendor or admin menu.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:cs-cart:cs-cart_multivendor:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cs-cart_multivendor",
            "vendor": "cs-cart",
            "versions": [
              {
                "status": "affected",
                "version": "4.16.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-26690",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T18:20:09.935141Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-434",
                "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T18:21:43.044Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via File Manager/Editor component in the vendor or admin menu."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-24T17:54:32.789916",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.cs-cart.com/multivendor.html"
        },
        {
          "url": "https://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26690%20-%20%20File%20Upload%20vulnerability%20in%20File%20Manager%20of%20CS-Cart%20MultiVendor%204.16.1"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-26690",
    "datePublished": "2024-09-24T00:00:00",
    "dateReserved": "2023-02-27T00:00:00",
    "dateUpdated": "2024-09-24T18:21:43.044Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-26686 (GCVE-0-2023-26686)

Vulnerability from cvelistv5 – Published: 2024-09-24 00:00 – Updated: 2024-09-24 17:12
VLAI?
Summary
File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the image upload feature when customizing a shop.
Severity ?
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:cs-cart:cs-cart_multivendor:*:*:*:*:japanese:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cs-cart_multivendor",
            "vendor": "cs-cart",
            "versions": [
              {
                "status": "affected",
                "version": "4.16.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-26686",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T17:08:46.765268Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-434",
                "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T17:12:44.087Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the image upload feature when customizing a shop."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-24T15:19:12.168549",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.cs-cart.com/multivendor.html"
        },
        {
          "url": "https://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26686%20-%20File%20Upload%20vulnerability%20in%20product%20image%20of%20CS-Cart%20MultiVendor%204.16.1"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-26686",
    "datePublished": "2024-09-24T00:00:00",
    "dateReserved": "2023-02-27T00:00:00",
    "dateUpdated": "2024-09-24T17:12:44.087Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-26687 (GCVE-0-2023-26687)

Vulnerability from cvelistv5 – Published: 2024-09-24 00:00 – Updated: 2024-09-24 18:47
VLAI?
Summary
Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to obtain sensitive information via the product_data parameter in the PDF Add-on.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:cs-cart:cs-cart_multivendor:*:*:*:*:japanese:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cs-cart_multivendor",
            "vendor": "cs-cart",
            "versions": [
              {
                "status": "affected",
                "version": "4.16.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-26687",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T18:42:59.528715Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T18:47:00.959Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to obtain sensitive information via the product_data parameter in the PDF Add-on."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-24T18:01:45.367587",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26687%20-%20Local%20File%20Inclusion%20vulnerability%20in%20CS-Cart%20MultiVendor"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-26687",
    "datePublished": "2024-09-24T00:00:00",
    "dateReserved": "2023-02-27T00:00:00",
    "dateUpdated": "2024-09-24T18:47:00.959Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-10886 (GCVE-0-2017-10886)

Vulnerability from cvelistv5 – Published: 2017-11-17 14:00 – Updated: 2024-08-05 17:50
VLAI?
Summary
Cross-site scripting vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Severity ?
No CVSS data available.
CWE
  • Cross-site scripting
Assigner
References
https://jvn.jp/en/jp/JVN29602086/index.html third-party-advisoryx_refsource_JVN
http://tips.cs-cart.jp/fix-jvn-29602086.html x_refsource_CONFIRM
Impacted products
Vendor Product Version
Frogman Office Inc. CS-Cart Japanese Edition Affected: v4.3.10 and earlier (excluding v2 and v3)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T17:50:12.728Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "JVN#29602086",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN29602086/index.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tips.cs-cart.jp/fix-jvn-29602086.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CS-Cart Japanese Edition",
          "vendor": "Frogman Office Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "v4.3.10 and earlier (excluding v2 and v3)"
            }
          ]
        },
        {
          "product": "CS-Cart Multivendor Japanese Edition",
          "vendor": "Frogman Office Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "v4.3.10 and earlier (excluding v2 and v3)"
            }
          ]
        }
      ],
      "datePublic": "2017-11-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows an attacker to inject arbitrary web script or HTML via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-17T13:57:01",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "name": "JVN#29602086",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "https://jvn.jp/en/jp/JVN29602086/index.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tips.cs-cart.jp/fix-jvn-29602086.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2017-10886",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "CS-Cart Japanese Edition",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "v4.3.10 and earlier (excluding v2 and v3)"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CS-Cart Multivendor Japanese Edition",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "v4.3.10 and earlier (excluding v2 and v3)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Frogman Office Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows an attacker to inject arbitrary web script or HTML via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "JVN#29602086",
              "refsource": "JVN",
              "url": "https://jvn.jp/en/jp/JVN29602086/index.html"
            },
            {
              "name": "http://tips.cs-cart.jp/fix-jvn-29602086.html",
              "refsource": "CONFIRM",
              "url": "http://tips.cs-cart.jp/fix-jvn-29602086.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2017-10886",
    "datePublished": "2017-11-17T14:00:00",
    "dateReserved": "2017-07-04T00:00:00",
    "dateUpdated": "2024-08-05T17:50:12.728Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-2138 (GCVE-0-2017-2138)

Vulnerability from cvelistv5 – Published: 2017-08-02 16:00 – Updated: 2024-08-05 13:39
VLAI?
Summary
Cross-site request forgery (CSRF) vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Severity ?
No CVSS data available.
CWE
  • Cross-site request forgery
Assigner
References
Impacted products
Vendor Product Version
Frogman Office Inc. CS-Cart Japanese Edition Affected: v4.3.10 and earlier (excluding v2 and v3)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T13:39:32.358Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "JVN#87770873",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN87770873/index.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://tips.cs-cart.jp/fix-csrf-20170406.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CS-Cart Japanese Edition",
          "vendor": "Frogman Office Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "v4.3.10 and earlier (excluding v2 and v3)"
            }
          ]
        },
        {
          "product": "CS-Cart Multivendor Japanese Edition",
          "vendor": "Frogman Office Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "v4.3.10 and earlier (excluding v2 and v3)"
            }
          ]
        }
      ],
      "datePublic": "2017-08-02T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site request forgery (CSRF) vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows remote attackers to hijack the authentication of administrators via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site request forgery",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-02T15:57:02",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "name": "JVN#87770873",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "https://jvn.jp/en/jp/JVN87770873/index.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://tips.cs-cart.jp/fix-csrf-20170406.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2017-2138",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "CS-Cart Japanese Edition",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "v4.3.10 and earlier (excluding v2 and v3)"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CS-Cart Multivendor Japanese Edition",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "v4.3.10 and earlier (excluding v2 and v3)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Frogman Office Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site request forgery (CSRF) vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows remote attackers to hijack the authentication of administrators via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site request forgery"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "JVN#87770873",
              "refsource": "JVN",
              "url": "https://jvn.jp/en/jp/JVN87770873/index.html"
            },
            {
              "name": "http://tips.cs-cart.jp/fix-csrf-20170406.html",
              "refsource": "MISC",
              "url": "http://tips.cs-cart.jp/fix-csrf-20170406.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2017-2138",
    "datePublished": "2017-08-02T16:00:00",
    "dateReserved": "2016-12-01T00:00:00",
    "dateUpdated": "2024-08-05T13:39:32.358Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-26689 (GCVE-0-2023-26689)

Vulnerability from nvd – Published: 2024-09-24 00:00 – Updated: 2024-09-24 18:58
VLAI?
Summary
An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request.
Severity ?
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:cs-cart:cs-cart_multivendor:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cs-cart_multivendor",
            "vendor": "cs-cart",
            "versions": [
              {
                "status": "affected",
                "version": "4.16.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-26689",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T18:57:25.887710Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-286",
                "description": "CWE-286 Incorrect User Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T18:58:26.643Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-24T18:02:26.383567",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26689%20-%20Insufficient%20Authorization%20for%20API%20key%20creation%20in%20CS-Cart%20MultiVendor%204.16.1"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-26689",
    "datePublished": "2024-09-24T00:00:00",
    "dateReserved": "2023-02-27T00:00:00",
    "dateUpdated": "2024-09-24T18:58:26.643Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-26688 (GCVE-0-2023-26688)

Vulnerability from nvd – Published: 2024-09-24 00:00 – Updated: 2024-09-24 17:23
VLAI?
Summary
Cross Site Scripting (XSS) vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the product_data parameter of add/edit product in the administration interface.
Severity ?
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:cs-cart:cs-cart_multivendor:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cs-cart_multivendor",
            "vendor": "cs-cart",
            "versions": [
              {
                "status": "affected",
                "version": "4.16.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-26688",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T17:09:46.910563Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T17:23:13.212Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross Site Scripting (XSS) vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the product_data parameter of add/edit product in the administration interface."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-24T15:21:07.397095",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.cs-cart.com/multivendor.html"
        },
        {
          "url": "https://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26688%20-%20Cross%20Site%20Scripting%20%28XSS%29%20vulnerability%20in%20CS-Cart%20MultiVendor%204.16.1"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-26688",
    "datePublished": "2024-09-24T00:00:00",
    "dateReserved": "2023-02-27T00:00:00",
    "dateUpdated": "2024-09-24T17:23:13.212Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-26691 (GCVE-0-2023-26691)

Vulnerability from nvd – Published: 2024-09-24 00:00 – Updated: 2024-09-24 18:24
VLAI?
Summary
Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via crafted zip file when installing a new add-on.
Severity ?
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:cs-cart:cs-cart_multivendor:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cs-cart_multivendor",
            "vendor": "cs-cart",
            "versions": [
              {
                "status": "affected",
                "version": "4.16.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-26691",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T18:23:26.873104Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T18:24:14.319Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via crafted zip file when installing a new add-on."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-24T17:52:35.442005",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.cs-cart.com/multivendor.html"
        },
        {
          "url": "https://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26691%20-%20Zip%20Slip%20in%20CS-Cart%20MultiVendor%204.16.1"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-26691",
    "datePublished": "2024-09-24T00:00:00",
    "dateReserved": "2023-02-27T00:00:00",
    "dateUpdated": "2024-09-24T18:24:14.319Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-26690 (GCVE-0-2023-26690)

Vulnerability from nvd – Published: 2024-09-24 00:00 – Updated: 2024-09-24 18:21
VLAI?
Summary
File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via File Manager/Editor component in the vendor or admin menu.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:cs-cart:cs-cart_multivendor:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cs-cart_multivendor",
            "vendor": "cs-cart",
            "versions": [
              {
                "status": "affected",
                "version": "4.16.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-26690",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T18:20:09.935141Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-434",
                "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T18:21:43.044Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via File Manager/Editor component in the vendor or admin menu."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-24T17:54:32.789916",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.cs-cart.com/multivendor.html"
        },
        {
          "url": "https://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26690%20-%20%20File%20Upload%20vulnerability%20in%20File%20Manager%20of%20CS-Cart%20MultiVendor%204.16.1"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-26690",
    "datePublished": "2024-09-24T00:00:00",
    "dateReserved": "2023-02-27T00:00:00",
    "dateUpdated": "2024-09-24T18:21:43.044Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-26686 (GCVE-0-2023-26686)

Vulnerability from nvd – Published: 2024-09-24 00:00 – Updated: 2024-09-24 17:12
VLAI?
Summary
File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the image upload feature when customizing a shop.
Severity ?
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:cs-cart:cs-cart_multivendor:*:*:*:*:japanese:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cs-cart_multivendor",
            "vendor": "cs-cart",
            "versions": [
              {
                "status": "affected",
                "version": "4.16.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-26686",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T17:08:46.765268Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-434",
                "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T17:12:44.087Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the image upload feature when customizing a shop."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-24T15:19:12.168549",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.cs-cart.com/multivendor.html"
        },
        {
          "url": "https://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26686%20-%20File%20Upload%20vulnerability%20in%20product%20image%20of%20CS-Cart%20MultiVendor%204.16.1"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-26686",
    "datePublished": "2024-09-24T00:00:00",
    "dateReserved": "2023-02-27T00:00:00",
    "dateUpdated": "2024-09-24T17:12:44.087Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-26687 (GCVE-0-2023-26687)

Vulnerability from nvd – Published: 2024-09-24 00:00 – Updated: 2024-09-24 18:47
VLAI?
Summary
Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to obtain sensitive information via the product_data parameter in the PDF Add-on.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:cs-cart:cs-cart_multivendor:*:*:*:*:japanese:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cs-cart_multivendor",
            "vendor": "cs-cart",
            "versions": [
              {
                "status": "affected",
                "version": "4.16.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-26687",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T18:42:59.528715Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T18:47:00.959Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to obtain sensitive information via the product_data parameter in the PDF Add-on."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-24T18:01:45.367587",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26687%20-%20Local%20File%20Inclusion%20vulnerability%20in%20CS-Cart%20MultiVendor"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-26687",
    "datePublished": "2024-09-24T00:00:00",
    "dateReserved": "2023-02-27T00:00:00",
    "dateUpdated": "2024-09-24T18:47:00.959Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-10886 (GCVE-0-2017-10886)

Vulnerability from nvd – Published: 2017-11-17 14:00 – Updated: 2024-08-05 17:50
VLAI?
Summary
Cross-site scripting vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Severity ?
No CVSS data available.
CWE
  • Cross-site scripting
Assigner
References
https://jvn.jp/en/jp/JVN29602086/index.html third-party-advisoryx_refsource_JVN
http://tips.cs-cart.jp/fix-jvn-29602086.html x_refsource_CONFIRM
Impacted products
Vendor Product Version
Frogman Office Inc. CS-Cart Japanese Edition Affected: v4.3.10 and earlier (excluding v2 and v3)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T17:50:12.728Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "JVN#29602086",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN29602086/index.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tips.cs-cart.jp/fix-jvn-29602086.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CS-Cart Japanese Edition",
          "vendor": "Frogman Office Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "v4.3.10 and earlier (excluding v2 and v3)"
            }
          ]
        },
        {
          "product": "CS-Cart Multivendor Japanese Edition",
          "vendor": "Frogman Office Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "v4.3.10 and earlier (excluding v2 and v3)"
            }
          ]
        }
      ],
      "datePublic": "2017-11-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows an attacker to inject arbitrary web script or HTML via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-17T13:57:01",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "name": "JVN#29602086",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "https://jvn.jp/en/jp/JVN29602086/index.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tips.cs-cart.jp/fix-jvn-29602086.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2017-10886",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "CS-Cart Japanese Edition",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "v4.3.10 and earlier (excluding v2 and v3)"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CS-Cart Multivendor Japanese Edition",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "v4.3.10 and earlier (excluding v2 and v3)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Frogman Office Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows an attacker to inject arbitrary web script or HTML via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "JVN#29602086",
              "refsource": "JVN",
              "url": "https://jvn.jp/en/jp/JVN29602086/index.html"
            },
            {
              "name": "http://tips.cs-cart.jp/fix-jvn-29602086.html",
              "refsource": "CONFIRM",
              "url": "http://tips.cs-cart.jp/fix-jvn-29602086.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2017-10886",
    "datePublished": "2017-11-17T14:00:00",
    "dateReserved": "2017-07-04T00:00:00",
    "dateUpdated": "2024-08-05T17:50:12.728Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-2138 (GCVE-0-2017-2138)

Vulnerability from nvd – Published: 2017-08-02 16:00 – Updated: 2024-08-05 13:39
VLAI?
Summary
Cross-site request forgery (CSRF) vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Severity ?
No CVSS data available.
CWE
  • Cross-site request forgery
Assigner
References
Impacted products
Vendor Product Version
Frogman Office Inc. CS-Cart Japanese Edition Affected: v4.3.10 and earlier (excluding v2 and v3)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T13:39:32.358Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "JVN#87770873",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN87770873/index.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://tips.cs-cart.jp/fix-csrf-20170406.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CS-Cart Japanese Edition",
          "vendor": "Frogman Office Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "v4.3.10 and earlier (excluding v2 and v3)"
            }
          ]
        },
        {
          "product": "CS-Cart Multivendor Japanese Edition",
          "vendor": "Frogman Office Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "v4.3.10 and earlier (excluding v2 and v3)"
            }
          ]
        }
      ],
      "datePublic": "2017-08-02T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site request forgery (CSRF) vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows remote attackers to hijack the authentication of administrators via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site request forgery",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-02T15:57:02",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "name": "JVN#87770873",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "https://jvn.jp/en/jp/JVN87770873/index.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://tips.cs-cart.jp/fix-csrf-20170406.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2017-2138",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "CS-Cart Japanese Edition",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "v4.3.10 and earlier (excluding v2 and v3)"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CS-Cart Multivendor Japanese Edition",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "v4.3.10 and earlier (excluding v2 and v3)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Frogman Office Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site request forgery (CSRF) vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows remote attackers to hijack the authentication of administrators via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site request forgery"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "JVN#87770873",
              "refsource": "JVN",
              "url": "https://jvn.jp/en/jp/JVN87770873/index.html"
            },
            {
              "name": "http://tips.cs-cart.jp/fix-csrf-20170406.html",
              "refsource": "MISC",
              "url": "http://tips.cs-cart.jp/fix-csrf-20170406.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2017-2138",
    "datePublished": "2017-08-02T16:00:00",
    "dateReserved": "2016-12-01T00:00:00",
    "dateUpdated": "2024-08-05T13:39:32.358Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}