OpenCart vulnerabilities
We track 7 vulnerabilities in OpenCart products across 2 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on March 25, 2026.
Latest OpenCart vulnerabilities
- 8.2 High severity
OpenCart Core: Improper Neutralization of Special Elements used in an SQL Command
OpenCart Core 4.0.2.3 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'search' parameter. Attackers can send GET requests to the product search endpoint with maliciou
- 7.2 High severity
This affects versions of the package opencart/opencart from 4.0.0.0.
This affects versions of the package opencart/opencart from 4.0.0.0. An Arbitrary File Creation issue was identified via the database restoration functionality. By injecting PHP code into the database, an attacker with admin privileges can create a backup file
- 7.2 High severity
opencart/opencart: Improper Limitation of a Pathname to a Restricted Directory
This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extr
- 8.1 High severity
opencart/opencart: Improper Neutralization of Special Elements used in an SQL Command
This affects versions of the package opencart/opencart from 0.0.0. An SQL Injection issue was identified in the Divido payment extension for OpenCart, which is included by default in version 3.0.3.9. As an anonymous unauthenticated user, if the Divido payment
- 8.8 High severity
Opencart: Improper Control of Generation of Code
An issue discovered in OpenCart 4.0.0.0 to 4.0.2.3 allows authenticated backend users having common/security write privilege can write arbitrary untrusted data inside config.php and admin/config.php, resulting in remote code execution on the underlying server.
- 8.8 High severity
Opencart: Improper Limitation of a Pathname to a Restricted Directory
Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 allows an authenticated user with access/modify privilege on the Log component to empty out arbitrary files on the server
- 9.8 Critical severity
Opencart: Improper Restriction of Excessive Authentication Attempts
OpenCart CMS v4.0.2.2 was discovered to lack a protective mechanism on its login page against excessive login attempts, allowing unauthenticated attackers to gain access to the application via a brute force attack to the password parameter.