Vulnerabilities > Tomatocart
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2014-10-20 | CVE-2014-3978 | SQL Injection vulnerability in Tomatocart 1.1.8.6.1 SQL injection vulnerability in TomatoCart 1.1.8.6.1 allows remote authenticated users to execute arbitrary SQL commands via the First Name and Last Name fields in a new address book contact. | 6.5 |
2014-10-20 | CVE-2014-3830 | Cross-Site Scripting vulnerability in Tomatocart 1.1.8.6.1 Cross-site scripting (XSS) vulnerability in info.php in TomatoCart 1.1.8.6.1 allows remote attackers to inject arbitrary web script or HTML via the faqs_id parameter. | 4.3 |
2012-11-17 | CVE-2012-5907 | Path Traversal vulnerability in Tomatocart 1.2.0 Directory traversal vulnerability in json.php in TomatoCart 1.2.0 Alpha 2 and possibly earlier allows remote attackers to read arbitrary files via a .. | 5.0 |
2012-10-31 | CVE-2012-4934 | Permissions, Privileges, and Access Controls vulnerability in Tomatocart 1.1.7 TomatoCart 1.1.7, when the PayPal Express Checkout module is enabled in sandbox mode, allows remote authenticated users to bypass intended payment requirements by modifying a certain redirection URL. | 3.5 |
2011-09-24 | CVE-2011-3811 | Information Exposure vulnerability in Tomatocart 1.1.3 TomatoCart 1.1.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by templates/system/offline.php and certain other files. | 5.0 |