express-cart@1.1.4 vulnerabilities
A fully functioning Node.js shopping cart with Stripe, PayPal and Authorize.net payments.
-
latest version
1.1.17
-
first published
9 years ago
-
latest version published
5 years ago
-
licenses detected
- >=1.1.4
Direct Vulnerabilities
Known vulnerabilities in the express-cart package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.| Vulnerability | Vulnerable Version |
|---|---|
express-cart is a fully functional shopping cart built in Node.js (Express, MongoDB) with Stripe, PayPal and Authorize.net payments. Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) due to missing checks in the Admin API, allowing attackers to add an administrator account, add a discount code or perform other unspecified behavior. How to fix Cross-site Request Forgery (CSRF)? Upgrade |
<1.1.11
|
express-cart is a fully functional shopping cart built in Node.js (Express, MongoDB) with Stripe, PayPal and Authorize.net payments. Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via How to fix Cross-site Request Forgery (CSRF)? A fix was pushed into the |
*
|
express-cart is a fully functional shopping cart built in Node.js (Express, MongoDB) with Stripe, PayPal and Authorize.net payments. Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It allows a user to insert malicious payload in the user input field and the script gets reflected in the browser. How to fix Cross-site Scripting (XSS)? There is no fixed version for |
*
|
express-cart is a fully functional shopping cart built in Node.js (Express, MongoDB) with Stripe, PayPal and Authorize.net payments. Affected versions of this package are vulnerable to SQL Injection due to a lack of user input sanitization in the login handlers. An attacker could enumerate the email address of the customers and the administrators. How to fix SQL Injection? Upgrade |
<1.1.8
|
Affected versions of this package are vulnerable to Privilege Escalation. Users from expressCart could add new users as administrators to the application due to deficiency in the access control. How to fix Privilege Escalation? Upgrade |
<1.1.6
|
express-cart is a fully functional shopping cart built in Node.js (Express, MongoDB) with Stripe, PayPal and Authorize.net payments. Affected versions of this package are vulnerable to Arbitrary Code Execution. It allows a privileged users to upload files to the server, and choose which path it'll be saved in. The path does not do through validation, nor is the file type or size validated. This may allow an attacker to upload malicious files that may execute code on the server, send data back to the attacker or cause a denial of service. How to fix Arbitrary Code Execution? Upgrade |
<1.1.7
|