Collne Inc. vulnerabilities

Products

• Welcart e-Commerce 11
• welcart 2
• Welcart e-Commerce (WordPress plugin) 1

Latest Collne Inc. CVEs

Newest publication first

1. CVE-2024-42404 Welcart e-Commerce <= 2.11.1 - Authenticated (Admin+) SQL Injection

   Published 2024-09-18

   High·CVSS 8.8 EPSS 0.48%

   SQL injection vulnerability in Welcart e-Commerce prior to 2.11.2 allows an attacker who can login to the product to obtain or alter the information stored in the database.

2. CVE-2023-50847 WordPress Welcart e-Commerce Plugin <= 2.9.3 is vulnerable to SQL Injection

   Published 2023-12-28

   High·CVSS 7.2 EPSS 0.53%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Collne Inc. Welcart e-Commerce.This issue affects Welcart e-Commerce: from n/a through 2.9.3.

3. CVE-2023-43614 Cross-site scripting vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script.

   Published 2023-09-26

   Medium·CVSS 6.1 EPSS 0.80%

   Cross-site scripting vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script.

4. CVE-2023-43610 Welcart e-Commerce <= 2.8.21 - Authenticated(Editor+) SQL Injection

   Published 2023-09-26

   High·CVSS 8.8 EPSS 1.2%

   SQL injection vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor (without setting authority) or higher privilege to perform unintended database operations.

5. CVE-2023-43493 Welcart e-Commerce <= 2.8.21 - Authenticated(level_5+) SQL Injection via get_logs

   Published 2023-09-26

   Medium·CVSS 4.9 EPSS 0.98%

   SQL injection vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to obtain sensitive information.

6. CVE-2023-43484 Cross-site scripting vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script.

   Published 2023-09-26

   Medium·CVSS 6.1 EPSS 0.80%

   Cross-site scripting vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script.

7. CVE-2023-41962 Cross-site scripting vulnerability in Credit Card Payment Setup page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script in the page.

   Published 2023-09-26

   Medium·CVSS 6.1 EPSS 0.73%

   Cross-site scripting vulnerability in Credit Card Payment Setup page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script in the page.

8. CVE-2023-41233 Cross-site scripting vulnerability in Item List page registration process of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script.

   Published 2023-09-26

   Medium·CVSS 6.1 EPSS 0.73%

   Cross-site scripting vulnerability in Item List page registration process of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script.

9. CVE-2023-40532 Path traversal vulnerability in Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to obtain partial information of the files on the web server.

   Published 2023-09-26

   Medium·CVSS 4.3 EPSS 0.72%

   Path traversal vulnerability in Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to obtain partial information of the files on the web server.

10. CVE-2023-40219 Welcart e-Commerce <= 2.8.21 - Authenticated(Editor+) Arbitrary File Upload

    Published 2023-09-26

    High·CVSS 7.2 EPSS 1.2%

    Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor or higher privilege to upload an arbitrary file to an unauthorized directory.

11. CVE-2023-22705 WordPress Welcart e-Commerce Plugin <= 2.8.10 is vulnerable to Cross Site Scripting (XSS)

    Published 2023-03-29

    Medium·CVSS 6.1 EPSS 0.43%

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Collne Inc. Welcart e-Commerce plugin <= 2.8.10 versions.

12. CVE-2022-41840 WordPress Welcart eCommerce plugin <= 2.7.7 - Unauth. Directory Traversal vulnerability

    Published 2022-11-18

    Critical·CVSS 9.8 EPSS 5.7%

    Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin <= 2.7.7 on WordPress.

13. CVE-2021-20734 Welcart e-Commerce <= 2.2.3 - Reflected Cross-Site Scripting

    Published 2021-06-22

    Medium·CVSS 6.1 EPSS 1.0%

    Cross-site scripting vulnerability in Welcart e-Commerce versions prior to 2.2.4 allows remote attackers to inject arbitrary script or HTML via unspecified vectors.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.