PT-2025-35513 · Unknown · Express-Cart

Zast.Ai · Published 2025-09-01 · Updated 2025-09-02 · CVE-2025-9797

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:N/AC:L/Au:M/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions expressCart versions prior to b31302f4e99c3293bd742c6d076a721e168118b0

Description A vulnerability exists in the Edit Product Page component of expressCart. The issue involves an injection flaw within an unknown function of the /admin/product/edit/ file. This manipulation can be initiated remotely, and the exploit has been publicly disclosed. Continuous delivery with rolling releases is used, and no specific version details for affected or updated releases are available.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Neutralization

Special Elements Injection

Weakness Enumeration

CWE-707

CWE-74

Related Identifiers

CVE-2025-9797

Affected Products

Express-Cart

References · 10

• 🔥 https://github.com/mrvautin/expressCart/issues/288#issue-3287867610 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9797 · Security Note
• https://github.com/mrvautin/expressCart/issues/288 · Note
• https://t.me/CVEtracker/31460 · Telegram Post
• https://vuldb.com/?ctiid.322112 · Note
• https://vuldb.com/?submit.641127 · Note
• https://t.me/cveNotify/134047 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1962644950761275627 · Twitter Post
• https://twitter.com/CVEnew/status/1962640215907971164 · Twitter Post
• https://vuldb.com/?id.322112 · Note