Vulnerability · Published Sep 1, 2025 · Assigned by VulDB

CVE-2025-9797mrvautin expressCart Edit Product edit injection

Low 2.4

In plain English

A low-severity injection in expressCart from mrvautin. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)2.4Low

Exploit odds (30 days)0.3%top 79.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in mrvautin expressCart up to b31302f4e99c3293bd742c6d076a721e168118b0. This impacts an unknown function of the file /admin/product/edit/ of the component Edit Product Page. This manipulation causes injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.

Affected products (as reported)

Vendor	Product	Versions
mrvautin	expressCart	b31302f4e99c3293bd742c6d076a721e168118b0

Weakness: CWE-74, CWE-707 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-322112 | mrvautin expressCart Edit Product edit injection vdb-entry
VDB-322112 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #641127 | mrvautin https://github.com/mrvautin/expressCart <=1.0.0 Frame Injection third-party-advisory
https://github.com/mrvautin/expressCart/issues/288 issue-tracking
https://github.com/mrvautin/expressCart/issues/288#issue-3287867610 exploit, issue-tracking