Vulnerability · Published Feb 1, 2026 · Assigned by VulnCheck
CVE-2021-47909Mult-E-Cart Ultimate 2.4 SQL Injection via Vulnerable ID Parameters
High 8.1
In plain English
A high-severity SQL injection in Digital Multivendor Marketplace Online Store from Techraft. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.4%top 68.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Mult-E-Cart Ultimate 2.4 contains multiple SQL injection vulnerabilities in inventory, customer, vendor, and order modules. Remote attackers with privileged vendor or admin roles can exploit the 'id' parameter to execute malicious SQL commands and compromise the database management system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Techraft | Digital Multivendor Marketplace Online Store | 2.4 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- Vulnerability Lab Advisory exploit
- Product Homepage product
- Product Homepage product
- VulnCheck Advisory: Mult-E-Cart Ultimate 2.4 SQL Injection via Vulnerable ID Parameters third-party-advisory