CVE-2026-18412 | Critical | 9.1 | 2026-08-10 | OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files… |
CVE-2021-47953 | Medium | 4.3 | 2026-05-10 | OpenCart 3.0.3.7 contains a cross-site request forgery vulnerability that allows attackers to change user passwords by sending crafted requests to the account/… |
CVE-2021-47946 | Medium | 5.3 | 2026-05-10 | OpenCart 3.0.3.6 contains a cross-site request forgery vulnerability in the /account/edit endpoint that allows unauthenticated attackers to modify victim accou… |
CVE-2021-47923 | Critical | 9.8 | 2026-05-10 | OpenCart 3.0.3.8 contains a session fixation vulnerability that allows attackers to hijack user sessions by injecting arbitrary values into the OCSESSID cookie… |
CVE-2024-58341 | High | 8.2 | 2026-03-25 | OpenCart Core 4.0.2.3 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through… |
CVE-2026-3714 | Medium | 4.7 | 2026-03-08 | A vulnerability has been found in OpenCart 4.0.2.3. Affected by this issue is the function Save of the file admin/controller/design/template.php of the compone… |
CVE-2025-15116 | Low | 3.7 | 2025-12-28 | A security flaw has been discovered in OpenCart up to 4.1.0.3. Affected by this issue is some unknown functionality of the component Single-Use Coupon Handler… |
CVE-2025-45893 | Medium | 6.1 | 2025-07-25 | OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts. The vulnerability arises because… |
CVE-2025-45892 | Medium | 6.1 | 2025-07-25 | OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via the blog editor. The vulnerability arises because input in the blog's… |
CVE-2025-1749 | Medium | 4.7 | 2025-02-28 | HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to modify the HTML of the victim's browser by… |
CVE-2025-1748 | Medium | 4.7 | 2025-02-28 | HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to modify the HTML of the victim's browser by… |
CVE-2025-1747 | Medium | 4.7 | 2025-02-28 | HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to modify the HTML of the victim's browser by… |
CVE-2025-1746 | Medium | 6.1 | 2025-02-28 | Cross-Site Scripting vulnerability in OpenCart versions prior to 4.1.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browse… |
CVE-2024-36694 | High | 7.2 | 2024-12-18 | OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the Theme Editor Function. |
CVE-2024-21519 | Medium | 6.6 | 2024-06-22 | This affects versions of the package opencart/opencart from 4.0.0.0. An Arbitrary File Creation issue was identified via the database restoration functionality… |
CVE-2024-21518 | High | 7.2 | 2024-06-22 | This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization… |
CVE-2024-21517 | Medium | 4.2 | 2024-06-22 | This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the redirect parameter of customer account/login r… |
CVE-2024-21516 | Medium | 4.2 | 2024-06-22 | This affects versions of the package opencart/opencart from 4.0.0.0 and before 4.1.0.0. A reflected XSS issue was identified in the directory parameter of admi… |
CVE-2024-21515 | Medium | 4.2 | 2024-06-22 | This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the filename parameter of the admin tool/log route… |
CVE-2024-21514 | High | 7.4 | 2024-06-22 | This affects versions of the package opencart/opencart from 0.0.0. An SQL Injection issue was identified in the Divido payment extension for OpenCart, which is… |
CVE-2023-47444 | High | 8.8 | 2023-11-15 | An issue discovered in OpenCart 4.0.0.0 to 4.0.2.3 allows authenticated backend users having common/security write privilege can write arbitrary untrusted data… |
CVE-2023-2315 | High | 8.1 | 2023-09-27 | Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 allows an authenticated user with access/modify privilege on the Log component to empty out arbitrary fi… |
CVE-2023-40834 | Critical | 9.8 | 2023-09-12 | OpenCart CMS v4.0.2.2 was discovered to lack a protective mechanism on its login page against excessive login attempts, allowing unauthenticated attackers to g… |
CVE-2020-20491 | High | 7.2 | 2023-06-20 | SQL injection vulnerability in OpenCart v.2.2.00 thru 3.0.3.2 allows a remote attacker to execute arbitrary code via the Fba plugin function in upload/admin/in… |
CVE-2021-37823 | Medium | 4.9 | 2022-11-03 | OpenCart 3.0.3.7 allows users to obtain database information or read server files through SQL injection in the background. |
CVE-2013-1891 | Medium | 6.5 | 2022-06-24 | In OpenCart 1.4.7 to 1.5.5.1, implemented anti-traversal code in filemanager.php is ineffective and can be bypassed. |
CVE-2020-29471 | Medium | 4.8 | 2020-12-29 | OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image. An admin can upload a profile image as a malicious code using JavaScript. When… |
CVE-2020-29470 | Medium | 4.8 | 2020-12-29 | OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail. This vulnerability can allow an attacker to inject the XSS payload in… |
CVE-2020-28838 | Low | 3.5 | 2020-12-11 | Cross Site Request Forgery (CSRF) in CART option in OpenCart Ltd. Opencart CMS 3.0.3.6 allows attacker to add cart items via Add to cart. |
CVE-2020-13980 | Medium | 4.8 | 2020-06-09 | OpenCart 3.0.3.3 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section because of a lack of entity… |
CVE-2020-10596 | Medium | 5.4 | 2020-03-17 | OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section. |
CVE-2019-15081 | Medium | 4.8 | 2019-08-15 | OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing feature of the Categories, Product, and I… |
CVE-2018-13067 | High | 8.8 | 2018-07-02 | /upload/catalog/controller/account/password.php in OpenCart through 3.0.2.0 has CSRF via the index.php?route=account/password URI to change a user's password. |
CVE-2018-11495 | Medium | 4.9 | 2018-05-26 | OpenCart through 3.0.2.0 allows directory traversal in the editDownload function in admin\model\catalog\download.php via admin/index.php?route=catalog/download… |
CVE-2018-11494 | High | 8.0 | 2018-05-26 | The "program extension upload" feature in OpenCart through 3.0.2.0 has a six-step process (upload, install, unzip, move, xml, remove) that allows attackers to… |
CVE-2014-3990 | Critical | 9.8 | 2018-03-20 | The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side request forgery (SSRF) a… |
CVE-2016-10509 | High | 7.2 | 2017-08-31 | SQL injection vulnerability in the updateAmazonOrderTracking function in upload/admin/model/openbay/amazon.php in OpenCart before version 2.3.0.0 allows remote… |
CVE-2015-4671 | Medium | 6.1 | 2016-01-12 | Cross-site scripting (XSS) vulnerability in OpenCart before 2.1.0.2 allows remote attackers to inject arbitrary web script or HTML via the zone_id parameter to… |
CVE-2011-3763 | | | 2011-09-24 | OpenCart 1.4.9.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error m… |
CVE-2010-1610 | | | 2010-04-29 | Cross-site request forgery (CSRF) vulnerability in index.php in OpenCart 1.4 allows remote attackers to hijack the authentication of an application administrat… |
CVE-2010-0956 | | | 2010-03-10 | SQL injection vulnerability in index.php in OpenCart 1.3.2 allows remote attackers to execute arbitrary SQL commands via the page parameter. |
CVE-2009-1621 | | | 2009-05-12 | Directory traversal vulnerability in index.php in OpenCart 1.1.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the route parameter. |
CVE-2009-1027 | | | 2009-03-20 | SQL injection vulnerability in OpenCart 1.1.8 allows remote attackers to execute arbitrary SQL commands via the order parameter. |