Description
Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.
Remediation
References
https://hackerone.com/reports/343726
Related Vulnerabilities
CVE-2023-22474 Vulnerability in npm package parse-server
CVE-2021-29300 Vulnerability in npm package opened
CVE-2022-45921 Vulnerability in maven package io.fusionauth:fusionauth-java-client
CVE-2020-7704 Vulnerability in npm package linux-cmdline
CVE-2021-43466 Vulnerability in maven package org.thymeleaf:thymeleaf-spring5