OpenCart security vulnerabilities
CMS / eCommerce / ERP. Public CVE monitoring for OpenCart. Vendor security advisories are linked on this page.
Built for Operators of this product.
45 public records · 0 security-fix timeline events. 0 published in the last 7 days. 34 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 0
- High 0
- Medium 0
- Low 0
2026-08-060 issues2026-11-03
Known exploited
View all known exploitedNo records match this view.
Recently published
Browse catalog- Medium6.9jCart for OpenCart 2.3.0.2 contains a cross-site request forgery vulnerability that allows attackers to modify user account information without authentication.Check if you run itEPSS 0.19%May 17, 2026
- Medium5.3OpenCart 3.0.3.7 contains a cross-site request forgery vulnerability that allows attackers to change user passwords by sending crafted requests to the account/password endpoint.Check if you run itEPSS 0.13%May 10, 2026
- Critical9.3OpenCart 3.0.3.8 contains a session fixation vulnerability that allows attackers to hijack user sessions by injecting arbitrary values into the OCSESSID cookie.Check if you run itEPSS 0.42%May 10, 2026
- Medium5.1A vulnerability has been found in OpenCart 4.0.2.3.Check if you run itEPSS 0.30%Mar 8, 2026
- Medium6.3A security flaw has been discovered in OpenCart up to 4.1.0.3.Check if you run itEPSS 0.41%Dec 28, 2025
- Medium6.1OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts.Check if you run itEPSS 0.28%Jul 25, 2025
- Medium6.1OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via the blog editor.Check if you run itEPSS 0.28%Jul 25, 2025
- Medium6.1Cross-Site Scripting vulnerability in OpenCart versions prior to 4.1.0.Check if you run itEPSS 0.23%Feb 28, 2025
- High7.2OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the Theme Editor Function.Check if you run itEPSS 0.92%Dec 18, 2024
- High8.1This affects versions of the package opencart/opencart from 0.0.0.Check this weekEPSS 19.08%Jun 22, 2024