CVE-2019-25577
SeoToaster Ecommerce 3.0.0 Local File Inclusion via backend_theme
CVSS Score
5.5
EPSS Score
0.0%
EPSS Percentile
5th
SeoToaster Ecommerce 3.0.0 contains a local file inclusion vulnerability that allows authenticated attackers to read arbitrary files by manipulating path parameters in backend theme endpoints. Attackers can send POST requests to /backend/backend_theme/editcss/ or /backend/backend_theme/editjs/ with directory traversal sequences in the getcss or getjs parameters to retrieve file contents.
| CWE | CWE-22 |
| Vendor | seotoaster |
| Product | seotoaster ecommerce |
| Published | Mar 21, 2026 |
| Last Updated | Mar 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for seotoaster seotoaster ecommerce
Be the first to know when new medium vulnerabilities affecting seotoaster seotoaster ecommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
Seotoaster / SeoToaster Ecommerce
3.0.0
References
exploit-db.com: https://www.exploit-db.com/exploits/46190 seotoaster.com: https://www.seotoaster.com/shopping-cart/ seotoaster.com: https://www.seotoaster.com/downloads/seotoaster.v3.0.0.zip vulncheck.com: https://www.vulncheck.com/advisories/seotoaster-ecommerce-local-file-inclusion-via-backend-theme
Credits
Ihsan Sencan