CVE-2021-47953CWE-352csrf

CVE-2021-47953

Medium · published May 10, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
2.1
In the wild
Unconfirmed
What it is

OpenCart 3.0.3.7 contains a cross-site request forgery vulnerability that allows attackers to change user passwords by sending crafted requests to the account/password endpoint. Attackers can trick authenticated users into submitting hidden forms with new password values in the 'password' and 'confirm' parameters to hijack accounts.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00126 · 2.1th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-05-10T17:16Z
References (2)
https://www.exploit-db.com/exploits/49970 · [email protected]https://www.vulncheck.com/advisories/opencart-cross-site-request-forgery-via-account-password · [email protected]
EPSS history
Timeline
  • 10 MAY 12:52Z
    OpenCart 3.0.3.7 Cross-Site Request Forgery via account/password
    cvelistv5