Homepage
About Snyk

express-cart@1.1.14 vulnerabilities

A fully functioning Node.js shopping cart with Stripe, PayPal and Authorize.net payments.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the express-cart package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Cross-site Request Forgery (CSRF)

express-cart is a fully functional shopping cart built in Node.js (Express, MongoDB) with Stripe, PayPal and Authorize.net payments.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via admin.js.

How to fix Cross-site Request Forgery (CSRF)?

A fix was pushed into the master branch but not yet published.

*
  • M
Cross-site Scripting (XSS)

express-cart is a fully functional shopping cart built in Node.js (Express, MongoDB) with Stripe, PayPal and Authorize.net payments.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It allows a user to insert malicious payload in the user input field and the script gets reflected in the browser.

How to fix Cross-site Scripting (XSS)?

There is no fixed version for express-cart.

*
Go back to all versions of this package