GCVE - cpe:2.3:a:opencart:opencart:3.0.3.6:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:opencart:opencart:3.0.3.6:*:*:*:*:*:*:*

part: a version: 3.0.3.6 update: *

Vendor	Opencart (`f5def384-479e-584b-af09-ca24ddfc6912`)
Product	Opencart (`0f9ea7e5-7639-558d-b50e-fb47a083711e`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:docker/bitnami/opencart`	purl2cpe	2026-06-01 10:13:09.510876
`pkg:github/opencart/opencart`	purl2cpe	2026-06-01 10:13:09.510878
`pkg:sourceforge/opencart.mirror`	purl2cpe	2026-06-01 10:13:09.510879

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-47946`	vulnerable	2026-06-08 05:38:07.953618	OpenCart 3.0.3.6 Account Takeover via Cross Site Request Forgery MEDIUM (5.3) OpenCart 3.0.3.6 contains a cross-site request forgery vulnerability in the /account/edit endpoint that allows unauthenticated attackers to modify victim account details by tricking users into visiting malicious pages. Attackers can craft CSRF payloads that change victim email addresses and account information, then use password reset functionality to gain unauthorized access to compromised accounts. Published: 2026-05-10T12:44:02.503Z Updated: 2026-05-12T01:02:20.584Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/49407 https://www.opencart.com https://www.opencart.com/index.php?route=cms/download https://www.vulncheck.com/advisories/opencart-account-takeover-via-cross-site-request-forgery	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-29471`	vulnerable	2026-06-08 05:24:58.258059	Details available OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image. An admin can upload a profile image as a malicious code using JavaScript. Whenever anyone will see the profile picture, the code will execute and XSS will trigger. Published: 2020-12-29T16:21:00.000Z Updated: 2024-08-04T16:55:09.657Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/49098	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-29470`	vulnerable	2026-06-08 05:24:58.257556	Details available OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail. This vulnerability can allow an attacker to inject the XSS payload in the Subject field of the mail and each time any user will open that mail of the website, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload. Published: 2020-12-29T16:21:56.000Z Updated: 2024-08-04T16:55:10.410Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/49099	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-28838`	vulnerable	2026-06-08 05:23:56.475481	Details available Cross Site Request Forgery (CSRF) in CART option in OpenCart Ltd. Opencart CMS 3.0.3.6 allows attacker to add cart items via Add to cart. Published: 2020-12-11T14:19:41.000Z Updated: 2024-08-04T16:40:59.955Z Open on db.gcve.eu Reference links https://www.opencart.com/ https://www.exploit-db.com/exploits/49228	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.