{"id":"CVE-2018-13067","aliases":["GHSA-jwqr-jcwp-445w"],"url":"https://o3.security/vulnerability/CVE-2018-13067","summary":"OpenCart Cross-Site Request Forgery (CSRF)","details":"/upload/catalog/controller/account/password.php in OpenCart through 3.0.2.0 has CSRF via the index.php?route=account/password URI to change a user's password.","published":"2018-07-02T17:29:00.847Z","modified":"2026-07-08T17:15:05.790913Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"opencart/opencart","fixedVersion":null}],"fix":null,"references":[{"type":"EVIDENCE","url":"https://whitehatck01.blogspot.com/2018/06/opencart-v3-0-3-0-user-changes-password.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T17:15:05.790913Z"}}