Welcart

Welcart E-commerce

37 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.5

CVE-2026-49775

  • EPSS 0.19%
  • Veröffentlicht 15.06.2026 20:19:27
  • Zuletzt bearbeitet 15.06.2026 21:24:32

Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.

6.5

CVE-2025-47511

  • EPSS 0.46%
  • Veröffentlicht 09.06.2025 15:54:10
  • Zuletzt bearbeitet 23.04.2026 15:30:22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Path Traversal.This issue affects Welcart e-Commerce: from n/a through <= 2.11.13.

8.8

CVE-2025-27130

  • EPSS 0.4%
  • Veröffentlicht 01.04.2025 09:15:15
  • Zuletzt bearbeitet 08.07.2025 17:09:54

Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker who can access websites created using the...

6.1

CVE-2025-0511

  • EPSS 0.33%
  • Veröffentlicht 12.02.2025 12:15:29
  • Zuletzt bearbeitet 20.02.2025 20:35:03

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 2.11.9 due to insufficient input sanitization and output escaping. This makes it possible for unau...

6.1

CVE-2024-45366

  • EPSS 0.24%
  • Veröffentlicht 18.09.2024 06:15:02
  • Zuletzt bearbeitet 10.07.2025 13:21:56

Welcart e-Commerce prior to 2.11.2 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the user's web browser.

8.8

CVE-2024-42404

  • EPSS 0.47%
  • Veröffentlicht 18.09.2024 06:15:02
  • Zuletzt bearbeitet 10.07.2025 13:22:05

SQL injection vulnerability in Welcart e-Commerce prior to 2.11.2 allows an attacker who can login to the product to obtain or alter the information stored in the database.

4.3

CVE-2024-32144

  • EPSS 0.34%
  • Veröffentlicht 11.06.2024 16:15:27
  • Zuletzt bearbeitet 21.11.2024 09:14:32

Missing Authorization vulnerability in Welcart Inc. Welcart e-Commerce.This issue affects Welcart e-Commerce: from n/a through 2.9.14.

7.2

CVE-2023-50847

  • EPSS 0.53%
  • Veröffentlicht 28.12.2023 19:15:15
  • Zuletzt bearbeitet 28.04.2026 19:22:35

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Collne Inc. Welcart e-Commerce.This issue affects Welcart e-Commerce: from n/a through 2.9.3.

2.7

CVE-2023-6120

  • EPSS 0.46%
  • Veröffentlicht 09.12.2023 07:15:08
  • Zuletzt bearbeitet 08.04.2026 17:17:11

The Welcart e-Commerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.6 via the upload_certificate_file function. This makes it possible for administrators to upload .pem or .crt files to arbitrary...

8.8

CVE-2023-5953

Exploit
  • EPSS 0.48%
  • Veröffentlicht 04.12.2023 22:15:08
  • Zuletzt bearbeitet 29.05.2025 14:15:33

The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. As a result, any authenticated users, such as subscriber could upload...