These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4, specifically in the catalog/controller/account/address.php file of the Autocomplete Workflow. The manipulation of the address_1 argument results in cross-site scripting. This issue can be exploited remotely. The exploit has been made public, and although the vendor was contacted, no response was received.
A critical vulnerability exists in OpenCart v4.2.0.0, allowing attackers to write arbitrary files, including PHP web shells, into the webroot directory via malicious extension uploads. This vulnerability is caused by the OpenCart extension installer not validating extracted paths from uploaded zip files, which enables attackers to exploit path traversal sequences. OpenCart users and administrators should [truncated]