Search: “opencart”

19 stories

OpenCart 4.2.0.0 extension installer fails to validate zip extraction paths, allowing directory traversal (CVE-2026-18412) to write files outside intended directories.

CERT/CC VU#614868 discloses CVE-2026-18412, a directory traversal vulnerability in OpenCart v4.2.0.0's extension installer. The installer extracts uploaded .ocmod.zip files using zip entry filenames as filesystem paths without verifying the resolved path stays inside the intended directory. A malicious extension zip could result in arbitrary file writes outside the target directory.

CERT/CC Vulnerability NotesAug 10, 14:47 UTC · Aug 10, 2026Vulnerability CVE-2026-184121

New Credit Card Skimmer Targets WordPress, Magento, and OpenCart Sites

The Hacker NewsJun 26, 13:40 UTC · Jun 26, 2024Malware

Caesar Cipher Skimmer targets popular CMS used by e

Security AffairsJun 26, 11:07 UTC · Jun 26, 2024Malware

Cybercriminals Use Unicode to Hide Mongolian Skimmer in E

The Hacker NewsOct 11, 04:51 UTC · Oct 11, 2024Data breach

New AlienFox toolkit harvests credentials for tens of cloud services

Security AffairsMar 31, 20:37 UTC · Mar 31, 2023Malware

$20 per zero-day is already the WordPress plugin reality

TrendAI and CHT Security used an AI pipeline to find over 300 verified WordPress plugin zero-days at roughly $20 per vulnerability.

A pipeline built in three days by TrendAI and CHT Security, presented at Ekoparty Miami, paired AI-driven static analysis with automated Docker provisioning and Chrome DevTools MCP dynamic verification to surface more than 300 critical zero-days in WordPress plugins within 72 hours. The run consumed about 222 million tokens across 95 tasks, averaging roughly $20 per verified vulnerability, with findings including pre-auth RCE, SQL injection, privilege escalation, SSRF, and an AI-assembled downgrade attack chain. Dynamic verification eliminated over 80% of false positives, but manual review at 30-60 minutes per finding remains the bottleneck, straining ZDI and NIST triage backlogs.