CVE-2019-16123: Kartatopia Piluscart

High severity, CVSS 7.5. EPSS: 16.6% chance of exploitation in the next 30 days.

In Kartatopia PilusCart 1.4.1, the parameter filename in the file catalog.php is mishandled, leading to ../ Local File Disclosure.

Affected products

• Kartatopia Piluscart: up to and including 1.4.1

Published 2019-09-09. Last modified 2026-06-17.