CVE-2020-29471

MEDIUM

OpenCart 3.0.3.6 - Stored Cross-Site Scripting via Profile Image Upload

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-29471. PoCs published by Hemant Patidar.

AI-analyzed exploit summary This is a writeup describing a stored XSS vulnerability in OpenCart 3.0.3.6 via the 'Profile Image' upload feature. The attacker uploads a malicious PNG file containing an XSS payload, which triggers when the image is rendered.

Description

OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image. An admin can upload a profile image as a malicious code using JavaScript. Whenever anyone will see the profile picture, the code will execute and XSS will trigger.

Exploits (1)

exploitdb WRITEUP
by Hemant Patidar · textwebappsphp
https://www.exploit-db.com/exploits/49098

This is a writeup describing a stored XSS vulnerability in OpenCart 3.0.3.6 via the 'Profile Image' upload feature. The attacker uploads a malicious PNG file containing an XSS payload, which triggers when the image is rendered.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: OpenCart 3.0.3.6
Auth required
Prerequisites: Authenticated access to the OpenCart admin panel
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
https://www.exploit-db.com/exploits/49098

Scores

CVSS v3 4.8
EPSS 0.0055
EPSS Percentile 68.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (2)
opencart/opencart 3.0.3.6
opencart/opencart Packagist
Published Dec 29, 2020
Tracked Since Feb 18, 2026