Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2853▼ 343 respecto a la semana anterior

Críticas / altas1376▼ 50 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)339▼ 171 respecto a la semana anterior

9 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2023-26691	Analizada	Alta (7.2)	1.2%	—	Cs-cart Multivendor	25/9/2024	17/6/2026	Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via crafted zip file when installing a new add-on.
CVE-2023-26690	Analizada	Alta (8.8)	0.68%	—	Cs-cart Multivendor	25/9/2024	17/6/2026	File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via File Manager/Editor component in the vendor or admin menu.
CVE-2023-26689	Analizada	Crítica (9.8)	0.62%	—	Cs-cart Multivendor	25/9/2024	17/6/2026	An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request.
CVE-2023-26688	Analizada	Media (5.4)	0.45%	—	Cs-cart Multivendor	25/9/2024	17/6/2026	Cross Site Scripting (XSS) vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the product_data parameter of add/edit product in the administration interface.
CVE-2023-26687	Analizada	Alta (8.8)	1.3%	—	Cs-cart Multivendor	25/9/2024	17/6/2026	Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to obtain sensitive information via the product_data parameter in the PDF Add-on.
CVE-2023-26686	Analizada	Crítica (9.8)	0.71%	—	Cs-cart Multivendor	25/9/2024	17/6/2026	File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the image upload feature when customizing a shop.
CVE-2017-10886	Modificada	Media (5.4)	0.54%	—	Cs-cart Cs-cart Multivendor	17/11/2017	17/6/2026	Cross-site scripting vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2138	Modificada	Alta (8.8)	1.0%	—	Cs-cart Cs-cart Multivendor	2/8/2017	17/6/2026	Cross-site request forgery (CSRF) vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVE-2017-2143	Modificada	Media (5.3)	1.2%	—	Frogman Office INC Cs-cart Japanese Edition Frogman Office INC Cs-cart Multivendor Japanese Edition	28/4/2017	17/6/2026	CS-Cart Japanese Edition v4.3.10-jp-1 and earlier, CS-Cart Multivendor Japanese Edition v4.3.10-jp-1 and earlier allows remote attackers to bypass access restriction to create a request to return a customer purchased item via rma.post.php.