https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2006-6464.htmlhttps://patchthecve.com/cve/CVE-2006-6464.htmlTue, 16 Jun 2026 22:33:10 +0000MEDIUM 5.0: viewcart in Midicart accepts negative numbers in the Qty (quantity) field, which allows remote attackers to obtain a smaller total price for a shopping cart.https://patchthecve.com/cve/CVE-2006-6463.htmlhttps://patchthecve.com/cve/CVE-2006-6463.htmlTue, 16 Jun 2026 22:33:10 +0000MEDIUM 6.5: Unrestricted file upload vulnerability in admin/add.php in Midicart allows remote authenticated users to upload arbitrary .php files, and possibly other files, to the images/ directory under the web root.https://patchthecve.com/cve/CVE-2005-2601.htmlhttps://patchthecve.com/cve/CVE-2005-2601.htmlTue, 16 Jun 2026 22:15:16 +0000HIGH 7.5: SQL injection vulnerability in MidiCart allows remote attackers to execute arbitrary SQL commands via the code_no parameter to (1) Item_Show.asp or (2) search_list.asp.https://patchthecve.com/cve/CVE-2005-1502.htmlhttps://patchthecve.com/cve/CVE-2005-1502.htmlTue, 16 Jun 2026 22:13:09 +0000MEDIUM 6.8: Cross-site scripting (XSS) vulnerability in MidiCart PHP Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the (1) searchstring parameter to search_list.php or the (2) secondgroup or (3) maingroup parameters to item_list.php.https://patchthecve.com/cve/CVE-2005-1501.htmlhttps://patchthecve.com/cve/CVE-2005-1501.htmlTue, 16 Jun 2026 22:13:09 +0000HIGH 7.5: MidiCart PHP Shopping Cart allows remote attackers to obtain sensitive information via a direct request to (1) search_list.php, (2) item_list.php, or (3) item_show.php, which reveal the path in a PHP error message.