Vulnerabilities > Tomatocart

DATE CVE VULNERABILITY TITLE RISK
2014-10-20 CVE-2014-3978 SQL Injection vulnerability in Tomatocart 1.1.8.6.1
SQL injection vulnerability in TomatoCart 1.1.8.6.1 allows remote authenticated users to execute arbitrary SQL commands via the First Name and Last Name fields in a new address book contact.
network
low complexity
tomatocart CWE-89
6.5
2014-10-20 CVE-2014-3830 Cross-Site Scripting vulnerability in Tomatocart 1.1.8.6.1
Cross-site scripting (XSS) vulnerability in info.php in TomatoCart 1.1.8.6.1 allows remote attackers to inject arbitrary web script or HTML via the faqs_id parameter.
network
tomatocart CWE-79
4.3
2012-11-17 CVE-2012-5907 Path Traversal vulnerability in Tomatocart 1.2.0
Directory traversal vulnerability in json.php in TomatoCart 1.2.0 Alpha 2 and possibly earlier allows remote attackers to read arbitrary files via a ..
network
low complexity
tomatocart CWE-22
5.0
2012-10-31 CVE-2012-4934 Permissions, Privileges, and Access Controls vulnerability in Tomatocart 1.1.7
TomatoCart 1.1.7, when the PayPal Express Checkout module is enabled in sandbox mode, allows remote authenticated users to bypass intended payment requirements by modifying a certain redirection URL.
3.5
2011-09-24 CVE-2011-3811 Information Exposure vulnerability in Tomatocart 1.1.3
TomatoCart 1.1.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by templates/system/offline.php and certain other files.
network
low complexity
tomatocart CWE-200
5.0