Description
Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.
Remediation
References
https://hackerone.com/reports/343726
Related Vulnerabilities
CVE-2016-10735 Vulnerability in maven package li.rudin.mavenjs:bootstrap
CVE-2021-42228 Vulnerability in npm package kindeditor
CVE-2011-1772 Vulnerability in maven package com.opensymphony:xwork-core
CVE-2022-25231 Vulnerability in npm package node-opcua
CVE-2021-4245 Vulnerability in maven package org.webjars.npm:rfc6902