CVE-2018-19468: Hucart

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

HuCart 5.7.4 has SQL injection in get_ip() in system/class/helper_class.php via the X-Forwarded-For HTTP header to the user/index.php?load=login&act=act_login URI.

Affected products

• Hucart Hucart: version 5.7.4 only

Published 2018-11-23. Last modified 2026-06-17.