uscnanbu vulnerabilities

CVEs per yearBy the year they were published

1. 20233
2. 20255
3. 20266

Newest CVEs

• CVE-2026-119166

  Welcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter

  uscnanbu · Welcart e-Commerce

  Medium5.3
• CVE-2026-118070

  Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter

  uscnanbu · Welcart e-Commerce

  High7.2
• CVE-2026-107752

  Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie

  uscnanbu · Welcart e-Commerce

  Medium4.9
• CVE-2026-87091

  Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters

  uscnanbu · Welcart e-Commerce

  High7.2
• CVE-2026-19887

  Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback

  uscnanbu · Welcart e-Commerce

  High8.8
• CVE-2026-19914

  Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter

  uscnanbu · Welcart e-Commerce

  High7.2
• CVE-2025-12979

  Welcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure

  uscnanbu · Welcart e-Commerce

  Medium5.3
• CVE-2025-10651

  Welcart e-Commerce <= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail

  uscnanbu · Welcart e-Commerce

  Medium5.5
• CVE-2025-10649

  Welcart e-Commerce <= 2.11.21 - Authenticated (Author+) SQL Injection via Cookie

  uscnanbu · Welcart e-Commerce

  Medium6.5
• CVE-2025-9367

  Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting

  uscnanbu · Welcart e-Commerce

  Medium5.5