VendorsTomatoCarttomatocartall versions
Vulnerabilities

TomatoCart Tomatocart

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

5CVEs
CVE-2014-3978
SQL injection vulnerability in TomatoCart 1.1.8.6.1 allows remote authenticated users to execute arbitrary SQL commands via the First Name and Last Name fields in a new address book contact.
Published 2014-10-20 · Modified
6.51 PoCEPSS 0.017
CVE-2012-5907
Directory traversal vulnerability in json.php in TomatoCart 1.2.0 Alpha 2 and possibly earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the module parameter in a "3" action.
Published 2012-11-17 · Modified
5.01 PoCEPSS 0.077
CVE-2011-3811
TomatoCart 1.1.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by templates/system/offline.php and certain other files.
Published 2011-09-24 · Modified
5.0EPSS 0.012
CVE-2014-3830
Cross-site scripting (XSS) vulnerability in info.php in TomatoCart 1.1.8.6.1 allows remote attackers to inject arbitrary web script or HTML via the faqs_id parameter.
Published 2014-10-20 · Modified
4.3EPSS 0.014
CVE-2012-4934
TomatoCart 1.1.7, when the PayPal Express Checkout module is enabled in sandbox mode, allows remote authenticated users to bypass intended payment requirements by modifying a certain redirection URL.
Published 2012-10-31 · Modified
3.5EPSS 0.013