nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2021-47946 CVE-2021-47946
MEDIUM
OpenCart 3.0.3.6 Account Takeover via Cross Site Request Forgery
Record summary
CVE-2021-47946 has a selected CVSS score of 6.9 (medium); EIP currently links 1 catalogued exploit.
Description
OpenCart 3.0.3.6 contains a cross-site request forgery vulnerability in the /account/edit endpoint that allows unauthenticated attackers to modify victim account details by tricking users into visiting malicious pages. Attackers can craft CSRF payloads that change victim email addresses and account information, then use password reset functionality to gain unauthorized access to compromised accounts.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated May 11, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
OpenCartBrowse Opencart / OpenCart | CVE List | 3.0.3.6 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBOpenCart 3.0.36 - ATO via Cross Site Request ForgeryExploitDB exploitby Mahendra PurbiaNot analyzed1 file
References
5ExploitDB-49407exploit
https://www.exploit-db.com/exploits/49407 Official Product Homepageproduct
https://www.opencart.com/ Product Referenceproduct
https://www.opencart.com/index.php?route=cms/download VulnCheck Advisory: OpenCart 3.0.36 Account Takeover via Cross Site Request ForgeryThird-party advisory
https://www.vulncheck.com/advisories/opencart-account-takeover-via-cross-site-request-forgery