Description
Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.
Remediation
References
https://hackerone.com/reports/343726
Related Vulnerabilities
CVE-2021-32855 Vulnerability in npm package vditor
CVE-2023-31580 Vulnerability in maven package com.networknt:light-oauth2
CVE-2022-31108 Vulnerability in maven package org.webjars.npm:mermaid
CVE-2022-0401 Vulnerability in npm package w-zip
CVE-2022-40150 Vulnerability in maven package org.codehaus.jettison:jettison