1.1.17
8 years ago
4 years ago
Known vulnerabilities in the express-cart package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for freeVulnerability | Vulnerable Version |
---|---|
express-cart is a fully functional shopping cart built in Node.js (Express, MongoDB) with Stripe, PayPal and Authorize.net payments. Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) due to missing checks in the Admin API, allowing attackers to add an administrator account, add a discount code or perform other unspecified behavior. How to fix Cross-site Request Forgery (CSRF)? Upgrade | <1.1.11 |
express-cart is a fully functional shopping cart built in Node.js (Express, MongoDB) with Stripe, PayPal and Authorize.net payments. Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via How to fix Cross-site Request Forgery (CSRF)? A fix was pushed into the | * |
express-cart is a fully functional shopping cart built in Node.js (Express, MongoDB) with Stripe, PayPal and Authorize.net payments. Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It allows a user to insert malicious payload in the user input field and the script gets reflected in the browser. How to fix Cross-site Scripting (XSS)? There is no fixed version for | * |