CVE-2014-8305: Open redirect vulnerability in the redir function in includes/function.php in C97net Cart Engine before 4.0...

Security readout for executives and security teams

This is a phishing-enablement flaw. A vulnerable C97net Cart Engine site can be abused as a trusted-looking jump point that sends visitors to an attacker-chosen external site. The bundle does not provide CVSS scoring, known exploitation, or detailed vendor remediation guidance. Exposure is limited to organizations still running C97net Cart Engine before 4.0, especially internet-facing storefronts. The structured affected metadata is incomplete, so version and product confirmation must come from asset inventory or application review. Prioritize if the affected store is public-facing or tied to customer trust. This is not shown as actively exploited in the bundle, but open redirects can materially support phishing and brand abuse. Mitigation focus: Identify any C97net Cart Engine deployments and confirm versions.; Upgrade, retire, or isolate deployments older than version 4.0.; Check vendor or project guidance before choosing a code-level fix..

Prepared

Jun 14, 2026, 13:53 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.