CVE-2024-36694: Opencart

High severity, CVSS 7.2. EPSS: 0.9% chance of exploitation in the next 30 days.

OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the Theme Editor Function.

Affected products

• Opencart Opencart: version 4.0.2.3 only

Published 2024-12-18. Last modified 2026-06-17.