MarcosCamara01 has 4 CVEs on record. 4 were published in the last 90 days. The median CVSS is 7.1 (high).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.1
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Worst active — by depth score
CVE-2026-90896High· 8.2Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts), exposed at GET /api/stripe/checkout_sessions, in MarcosCamara01 Ecommerce Template before comm…45CVE-2026-115453High· 7.1Cross user deletion and modification of cart and wishlist rows in Ecommerce Template through unscoped primary key queries39CVE-2026-115450High· 7.1Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier39CVE-2026-91154Medium· 6.9Missing Authentication for Critical Function (CWE-306) in the product cache revalidation Server Action (src/app/actions.ts, revalidateProducts) in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated a…38
MarcosCamara01 vulnerabilities
CVEs affecting MarcosCamara01, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-115453High· 7.1Cross user deletion and modification of cart and wishlist rows in Ecommerce Template through unscoped primary key queries
Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and modify the cart and wishlist rows of any other user, becaus…
CVE-2026-115450High· 7.1Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier
External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing…
CVE-2026-91154Medium· 6.9Missing Authentication for Critical Function (CWE-306) in the product cache revalidation Server Action (src/app/actions.ts, revalidateProducts) in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated a…
Missing Authentication for Critical Function (CWE-306) in the product cache revalidation Server Action (src/app/actions.ts, revalidateProducts) in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated a…
CVE-2026-90896High· 8.2Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts), exposed at GET /api/stripe/checkout_sessions, in MarcosCamara01 Ecommerce Template before comm…
Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts), exposed at GET /api/stripe/checkout_sessions, in MarcosCamara01 Ecommerce Template before comm…