Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
CVE-2025-0841: OpenCart News Component Allows Remote Code Execution
CVE-2025-0841 · published 1 year ago
Summary
A critical flaw in OpenCart's News component lets attackers execute code remotely. This affects users of OpenCart up to September 27, 2024. To protect your site, update the News component to the latest version.
Original advisory text
A vulnerability has been found in Aridius XYZ up to 20240927 on OpenCart and classified as critical. This vulnerability affects the function loadMore of the component News. The manipulation leads t...
A vulnerability has been found in Aridius XYZ up to 20240927 on OpenCart and classified as critical. This vulnerability affects the function loadMore of the component News. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-20Improper Input Validation
CWE-502Deserialization of Untrusted Data
Timeline
Published29 Jan 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-0841 · NVD
Track software like this
Free during beta