CVE-2025-9797

mrvautin expressCart Edit Product edit injection

State: Published
Severity: 4.8 Medium
Published: Sep 1, 2025
Updated: Sep 2, 2025
Reserved: Sep 1, 2025

Description

A vulnerability was determined in mrvautin expressCart up to b31302f4e99c3293bd742c6d076a721e168118b0. This impacts an unknown function of the file /admin/product/edit/ of the component Edit Product Page. This manipulation causes injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	2.4 Low	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R	VulDB
3.0	2.4 Low	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R	VulDB
2.0	3.3 Low	AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-74 Injection
CWE-707 Improper Neutralization

Affected Products

Product	Versions
expressCartmrvautin	b31302f4e99c3293bd742c6d076a721e168118b0Affected

References

VDB-322112 | mrvautin expressCart Edit Product edit injectionvdb-entry
VDB-322112 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #641127 | mrvautin https://github.com/mrvautin/expressCart <=1.0.0 Frame Injectionthird-party-advisory
https://github.com/mrvautin/expressCart/issues/288issue-tracking
https://github.com/mrvautin/expressCart/issues/288#issue-3287867610exploitissue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.