CVE-2018-12457: Expresscart Project Expresscart

High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days.

expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header.

Affected products

• Expresscart Project Expresscart: before 1.1.6 (fixed in 1.1.6)

Published 2018-06-15. Last modified 2026-06-17.