Cross-Site Request Forgery in express-cart

Description

References

• nvd.nist.gov/vuln/detail/CVE-2020-22403 · ADVISORY
• mrvautin/expressCart · WEB
• mrvautin/expressCart commit cd3ba1b · WEB
• hackerone.com/reports/395944 · WEB
• mrvautin/expressCart · PACKAGE
• security.netapp.com/advisory/ntap-20210909-0004 · WEB
• npmjs.com/package/express-cart · WEB

express-cart 的其他漏洞

• CVE-2021-32573中危 4.8The express-cart package through 1.1.10 for Node.js allows Reflected XSS (for an admin) via a user input field for product options. NOTE: th…
• CVE-2018-16483高危 8.8A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administr…
• CVE-2018-3758高危 8.8Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.