OpenCart 4.0.2.3
Approved changes feed: RSS · Atom
cpe:2.3:a:opencart:opencart:4.0.2.3:*:*:*:*:*:*:*
part: a version: 4.0.2.3 update: *
| Vendor | Opencart (f5def384-479e-584b-af09-ca24ddfc6912) |
|---|---|
| Product | Opencart (0f9ea7e5-7639-558d-b50e-fb47a083711e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/bitnami/opencart |
purl2cpe | 2026-06-01 10:13:09.510928 |
pkg:github/opencart/opencart |
purl2cpe | 2026-06-01 10:13:09.510929 |
pkg:sourceforge/opencart.mirror |
purl2cpe | 2026-06-01 10:13:09.510931 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-3714 |
vulnerable | 2026-06-08 08:01:19.228626 |
OpenCart Incomplete Fix CVE-2024-36694 template.php save special elements used in a template engine
MEDIUM (4.7)
A vulnerability has been found in OpenCart 4.0.2.3. Affected by this issue is the function Save of the file admin/controller/design/template.php of the component Incomplete Fix CVE-2024-36694. Such manipulation leads to improper neutralization of special elements used in a template engine. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-03-08T06:32:06.543Z
Updated: 2026-03-11T13:44:45.059Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-58341 |
vulnerable | 2026-06-08 06:56:14.485819 |
OpenCart Core 4.0.2.3 SQL Injection via search Parameter
HIGH (8.2)
OpenCart Core 4.0.2.3 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'search' parameter. Attackers can send GET requests to the product search endpoint with malicious 'search' values to extract sensitive database information using boolean-based blind or time-based blind SQL injection techniques.
Published: 2026-03-25T16:04:35.565Z
Updated: 2026-05-14T02:07:15.526Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-36694 |
vulnerable | 2026-06-08 06:39:45.612265 |
Details available
OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the Theme Editor Function.
Published: 2024-12-18T00:00:00.000Z
Updated: 2025-01-23T20:35:17.819Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.