Kartatopia: community verdicts

1 notable / known-exploited Kartatopia CVE the community has triaged.

ⓘ Not an exhaustive list: we focus on the findings that matter (exploited / notable). For every Kartatopia CVE, see NVD ↗.

CVE-2019-25672HIGH 8.2Real · low riskEPSS 0%
PilusCart 1.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'send' parameter. Attackers can submit POST requests to the comment submission endpoint with RLIKE-based boolean SQL injection payloads to extract sensitive database information.