AbanteCart vulnerabilities
We track 3 vulnerabilities in AbanteCart products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 27, 2025.
Latest AbanteCart vulnerabilities
- 9.8 Critical severity
Abantecart: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in AbanteCart 1.4.2, allows unauthenticated attackers to execute arbitrary SQL commands via the tmpl_id parameter to index.php. Three techniques have been demonstrated: error-based injection using a crafted FLOOR-based payload, time
- 7.5 High severity
Abantecart: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in AbanteCart version 1.4.2 allows unauthenticated attackers to gain access to sensitive system files via the template parameter to index.php.
- 7.2 High severity
Abantecart: Unrestricted Upload of File with Dangerous Type
Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Catalog>Media Manager>Images settings can be changed by an administrator (e.g., by configuring .php to be a valid image f