Cart Engine
Approved changes feed: RSS · Atom
cpe:2.3:a:c97:cart_engine:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | C97 (ac8107ef-57b3-5b68-ae71-861a047c9eef) |
|---|---|
| Product | Cart Engine (99301e4f-1696-53fa-82fb-4b47599b397f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/cunaedy/cart-engine |
purl2cpe | 2026-06-01 10:17:10.802104 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2014-125138 |
vulnerable | 2026-11-03 10:14:09.321076 |
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields
HIGH (8.8)
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image parameters to the web-accessible /public/image directory and request them to execute code on the server.
Published: 2026-10-28T02:03:13.805Z
Updated: 2026-11-02T19:54:09.045Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-125137 |
vulnerable | 2026-11-03 10:14:09.202823 |
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php
MEDIUM (6.5)
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by the web server.
Published: 2026-10-28T02:03:13.087Z
Updated: 2026-11-05T17:20:14.638Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-125136 |
vulnerable | 2026-11-03 10:14:09.124171 |
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup
MEDIUM (5.9)
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess date-based names like 'Full Backup YYYYMMDD.sql' to download dumps containing user records and administrator password hashes.
Published: 2026-10-28T02:03:12.414Z
Updated: 2026-10-28T16:12:26.616Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-8307 |
vulnerable | 2026-06-08 05:06:08.373178 |
Details available
Multiple cross-site scripting (XSS) vulnerabilities in skins/default/outline.tpl in C97net Cart Engine before 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) path parameter in the "drop down TOP menu (with path)" section or (2) print_this_page variable in the footer_content_block section, as demonstrated by the QUERY_STRING to (a) index.php, (b) checkout.php, (c) contact.php, (d) detail.php, (e) distro.php, (f) newsletter.php, (g) page.php, (h) profile.php, (i) search.php, (j) sitemap.php, (k) task.php, or (l) tell.php.
Published: 2014-10-16T19:00:00.000Z
Updated: 2024-09-17T00:37:12.368Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-8306 |
vulnerable | 2026-06-08 05:06:08.372868 |
Details available
SQL injection vulnerability in the sql_query function in cart.php in C97net Cart Engine before 4.0 allows remote attackers to execute arbitrary SQL commands via the item_id variable, as demonstrated by the (1) item_id[0] or (2) item_id[] parameter.
Published: 2014-10-16T19:00:00.000Z
Updated: 2024-09-16T17:33:08.580Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-8305 |
vulnerable | 2026-06-08 05:06:08.372476 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.