Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2023-26689: CS-Cart MultiVendor 4.16.1: User Account Profile Modification
CVE-2023-26689 · published 2 years ago
Summary
An attacker can modify any user's account profile by sending a specially crafted request. This could lead to unauthorized access to sensitive information or actions taken in the affected user's account. Update to the latest version of CS-Cart MultiVendor to fix this issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| cs-cart | cs-cart_multivendor |
4.16.1 cpe:2.3:a:cs-cart:cs-cart_multivendor:4.16.1:*:*:*:*:*:*:* |
Original advisory text
An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request.
An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request.
References
- https://github.com/cybrops-io/CVEs/tree/main/CVE-2023-26689%20-%20Insufficient%2... Exploit Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-286Incorrect User Management
Timeline
Published25 Sep 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2023-26689 · NVD
Track software like this
Free during beta