Aitor Herrero Fuentes

**Name of the Vulnerable Software and Affected Versions** SPA-Cart version 1.9.0.3 **Description** The issue allows a remote attacker to delete all accounts due to a Cross Site Request Forgery (CSRF) vulnerability. **Recommendations** For SPA-Cart version 1.9.0.3, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SPA-Cart version 1.9.0.3 **Description** The issue allows a remote attacker to add an admin user with role status due to Cross Site Request Forgery (CSRF). **Recommendations** For SPA-Cart version 1.9.0.3, at the moment, there is no information about a newer version that contains a fix for this vulnerability.