Projectworlds Online Shopping System vulnerabilities

4 CVEs affecting Projectworlds Online Shopping System, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-12215, published 2025-10-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-43157, published 2021-12-22. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Projectsworlds Online Shopping System PHP 1.0 is vulnerable to SQL injection via the id parameter in cart_remove.php.
CVE-2025-11070, published 2025-09-27. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability was identified in Projectworlds Online Shopping System 1.0. This affects an unknown part of the file /store/cart_add.php. Such manipulation of the argument ID leads to sql injection.…
CVE-2021-43158, published 2021-12-22. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. In ProjectWorlds Online Shopping System PHP 1.0, a CSRF vulnerability in cart_remove.php allows a remote attacker to remove any product in the customer's cart.
CVE-2025-12215, published 2025-10-27. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw has been found in projectworlds Online Shopping System 1.0. Impacted is an unknown function of the file /login_submit.php. Executing a manipulation of the argument keywords can lead to sql…