Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

OpenCart 3.0.3.7 allows attackers to change user passwords

CVE-2021-47953 · published 5 months ago
Summary

OpenCart, a popular e-commerce platform, has a security weakness that could allow malicious attackers to change a user's password without their knowledge. This could lead to unauthorized access to accounts and potentially sensitive information. To protect your business, update OpenCart to the latest version as soon as possible.

Original advisory text
OpenCart 3.0.3.7 contains a cross-site request forgery vulnerability that allows attackers to change user passwords by sending crafted requests to the account/password endpoint. Attackers can trick...
OpenCart 3.0.3.7 contains a cross-site request forgery vulnerability that allows attackers to change user passwords by sending crafted requests to the account/password endpoint. Attackers can trick authenticated users into submitting hidden forms with new password values in the 'password' and 'confirm' parameters to hijack accounts.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published10 May 2026
Updated26 Oct 2026
First seen10 May 2026
Sources
CVE-2021-47953 · NVD
Track software like this
Free during beta