Threats affecting pkg:github/OpenCart

OpenCart versions up to 4.1.0.4 have a business logic vulnerability that allows logged-in customers to bypass payment by manipulating reward points during checkout. Attackers can select Free Checkout, apply reward points, then clear them before finalizing the order, causing the system to advance the order without payment.