CVE-2018-19468

PoC —

CVSS 3.0

9.8 critical

EPSS

1%p65

Published

Nov 23, 2018 (Nov 23, 2018)

Modified

Jun 17, 2026

Description

HuCart 5.7.4 has SQL injection in get_ip() in system/class/helper_class.php via the X-Forwarded-For HTTP header to the user/index.php?load=login&act=act_login URI.

Vendors: hucart
Products: hucart
Weakness: CWE-89
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.1%)

In the news0 stories

No ingested article mentions this CVE yet.