受影响的版本系列
已知漏洞
| CVE | 标题 | 受影响版本 | CVSS | 被利用 | EPSS | 发布日期 |
|---|---|---|---|---|---|---|
| CVE-2026-119558 | OpenCart through 4.1.0.4 Payment Bypass via Free Checkout Reward Points | ≤ 4.1.0.4 | 2.3 | — | 2026-10-30 | |
| CVE-2026-18412 | The OpenCart v4.2.0.0 extension installer contains a directory traversal vulnerability | = 4.2.0.0 | 9.1 | — | 2026-08-10 | |
| CVE-2021-47953 | OpenCart 3.0.3.7 Cross-Site Request Forgery via account/password | = 3.0.3.7 | 5.3 | — | 2026-05-10 | |
| CVE-2021-47946 | OpenCart 3.0.3.6 Account Takeover via Cross Site Request Forgery | = 3.0.3.6 | 6.9 | — | 2026-05-10 | |
| CVE-2021-47923 | OpenCart 3.0.3.8 Session Fixation via OCSESSID Cookie | = 3.0.3.8 | 9.3 | — | 2026-05-10 | |
| CVE-2024-58341 | OpenCart Core 4.0.2.3 SQL Injection via search Parameter | * | 8.8 | — | 2026-03-26 | |
| CVE-2025-1749 | HTML injection vulnerability in OpenCart | < 4.1.0 | 4.7 | — | 2025-02-28 | |
| CVE-2025-1748 | HTML injection vulnerability in OpenCart | < 4.1.0 | 4.7 | — | 2025-02-28 | |
| CVE-2025-1747 | HTML injection vulnerability in OpenCart | < 4.1.0 | 4.7 | — | 2025-02-28 | |
| CVE-2025-1746 | Cross-Site Scripting vulnerability in OpenCart | < 4.1.0 | 6.1 | — | 2025-02-28 | |
| CVE-2024-36694 | OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the Theme Editor Function. | * | 7.2 | — | 2024-12-18 | |
| CVE-2024-21516 | This affects versions of the package opencart/opencart from 4.0.0.0 and before 4.1.0.0. A reflected XSS issue... | * | 2.1 | — | 2024-06-22 | |
| CVE-2024-21514 | This affects versions of the package opencart/opencart from 0.0.0. An SQL Injection issue was identified in th... | * | 7.4 | — | 2024-06-22 | |
| CVE-2024-21519 | This affects versions of the package opencart/opencart from 4.0.0.0. An Arbitrary File Creation issue was iden... | * | 6.6 | — | 2024-06-22 | |
| CVE-2024-21518 | This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the m... | * | 7.2 | — | 2024-06-22 | |
| CVE-2024-21517 | This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in t... | * | 2.1 | — | 2024-06-22 | |
| CVE-2024-21515 | This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in t... | * | 2.1 | — | 2024-06-22 | |
| CVE-2023-2315 | Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 | ≥ 4.0.0.0 ≤ 4.0.2.2 | 8.1 | — | 2023-09-26 | |
| CVE-2020-20491 | SQL injection vulnerability in OpenCart v.2.2.00 thru 3.0.3.2 allows a remote attacker to execute arbitrary co... | * | 7.2 | — | 2023-06-20 | |
| CVE-2020-13980 | OpenCart 3.0.3.3 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users'... | * | — | — | 2020-06-09 | |
| CVE-2020-10596 | OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users'... | * | — | — | 2020-03-17 | |
| CVE-2016-10509 | SQL injection vulnerability in the updateAmazonOrderTracking function in upload/admin/model/openbay/amazon.php... | * | — | — | 2017-09-01 | |
| CVE-2015-4671 | Cross-site scripting (XSS) vulnerability in OpenCart before 2.1.0.2 allows remote attackers to inject arbitrar... | * | — | — | 2016-01-13 |
数据来源：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS 详见 https://www.first.org/epss）、endoflife.date。软件列表：awesome-selfhosted（CC BY-SA 3.0）。