https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2007-4287.htmlhttps://patchthecve.com/cve/CVE-2007-4287.htmlTue, 16 Jun 2026 22:43:44 +0000HIGH 7.5: PHP remote file inclusion vulnerability in fc_functions/fc_example.php in FishCart 3.2 RC2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the docroot parameter.https://patchthecve.com/cve/CVE-2005-1487.htmlhttps://patchthecve.com/cve/CVE-2005-1487.htmlTue, 16 Jun 2026 22:13:08 +0000HIGH 7.5: Multiple SQL injection vulnerabilities in FishCart 3.1 allow remote attackers to execute arbitrary SQL commands via the (1) cartid parameter to upstnt.php or (2) psku parameter to display.php. NOTE: the vendor disputes this report, saying that they are forced SQL errors. The original researcher ishttps://patchthecve.com/cve/CVE-2005-1486.htmlhttps://patchthecve.com/cve/CVE-2005-1486.htmlTue, 16 Jun 2026 22:13:08 +0000MEDIUM 5.0: Multiple cross-site scripting vulnerabilities in FishCart 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) trackingnum, (2) reqagree, or (3) m parameter to upstracking.php or (4) nlst parameter to display.php. NOTE: the vendor was not able to reproduce some of the reporhttps://patchthecve.com/cve/CVE-2004-0062.htmlhttps://patchthecve.com/cve/CVE-2004-0062.htmlTue, 16 Jun 2026 22:04:51 +0000HIGH 7.5: Integer overflow in the rnd arithmetic rounding function for various versions of FishCart before 3.1 allows remote attackers to "cause negative totals" via an order with a large quantity.