GCVE - cpe:2.3:a:cs-cart:cs-cart_multivendor:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:cs-cart:cs-cart_multivendor:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Cs Cart (`8eacec83-fd2e-57be-9862-caefae47e2ee`)
Product	Cs Cart Multivendor (`ed6c337e-92d4-566a-84bc-748022d893c7`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/cscart/docs`	purl2cpe	2026-06-01 10:18:04.845837

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-26691`	vulnerable	2026-06-08 05:57:40.301998	Details available Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via crafted zip file when installing a new add-on. Published: 2024-09-24T00:00:00.000Z Updated: 2024-09-24T18:24:14.319Z Open on db.gcve.eu Reference links https://www.cs-cart.com/multivendor.html https://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26691%20-%20Zip%20Slip%20in%20CS-Cart%20MultiVendor%204.16.1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-26690`	vulnerable	2026-06-08 05:57:40.301598	Details available File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via File Manager/Editor component in the vendor or admin menu. Published: 2024-09-24T00:00:00.000Z Updated: 2024-09-24T18:21:43.044Z Open on db.gcve.eu Reference links https://www.cs-cart.com/multivendor.html https://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26690%20-%20%20File%20Upload%20vulnerability%20in%20File%20Manager%20of%20CS-Cart%20MultiVendor%204.16.1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-26689`	vulnerable	2026-06-08 05:57:40.301172	Details available An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request. Published: 2024-09-24T00:00:00.000Z Updated: 2024-09-24T18:58:26.643Z Open on db.gcve.eu Reference links https://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26689%20-%20Insufficient%20Authorization%20for%20API%20key%20creation%20in%20CS-Cart%20MultiVendor%204.16.1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-26688`	vulnerable	2026-06-08 05:57:40.300652	Details available Cross Site Scripting (XSS) vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the product_data parameter of add/edit product in the administration interface. Published: 2024-09-24T00:00:00.000Z Updated: 2024-09-24T17:23:13.212Z Open on db.gcve.eu Reference links https://www.cs-cart.com/multivendor.html https://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26688%20-%20Cross%20Site%20Scripting%20%28XSS%29%20vulnerability%20in%20CS-Cart%20MultiVendor%204.16.1	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.