CVE-2026-93617

The WordPress Sunshine Photo Cart plugin (versions

EUVD-2026-92749

Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1...

CVE-2026-102775

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key IDOR in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d download token and o order token parameters are checked for non-emptines...

CVE-2026-102775

The Joomla Extension - phoca.cz (specifically Phoca Cart versions 5.0.0 - 6.1.8 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in the order-file download endpoint. The application fails to validate provided d (download token) and o (order token) parameters against stored value...

CVE-2026-102775 Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key IDOR in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d download token and o order token parameters are checked for non-emptines...

CVE-2026-102775 Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key IDOR in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d download token and o order token parameters are checked for non-emptines...

CVE-2023-2986

CVE-2023-2986 のオリジナル Proof of Concept WordPress プラグイン 'Abandoned Cart Lite for WooCommerce' における脆弱性 CVE-2023-2986 の Proof of Concept 関連詳細 NVD Link : https://nvd.nist.gov/vuln/detail/CVE-2023-2986 Plugin Source : https://github.com/TycheSoftwares/woocommerce-abandoned-cart/ 影響を受けるバージョン : version=...

CVE-2024-8949-POC

Sourcecodester Online Eyewear Shopping Website で発見された Broken Access Control の脆弱性 - ID、カートIDの操作によりユーザーのカートへの不要な商品の追加・削除が発生する CVE-2024-8949 ベンダー: Sourcecodester https://www.sourcecodester.com/php/16089/online-eyewear-shop-website-using-php-and-mysql-free-download.html 参照:...

CVE-2021-27190-PEEL-Shopping-cart-9.3.0-Stored-XSS

CVE-2021-27190 - PEEL Shopping、eコマースショッピングカート - 'Address' における格納型クロスサイトスクリプティング脆弱性 日付 2021-02-11 脆弱性発見者 Anmol K Sachan ベンダーホームページ https://www.peel.fr/ ソフトウェアリンク https://www.peel.fr/nos-offres-1/peel-shopping-31.html https://sourceforge.net/projects/peel-shopping/ 脆弱性のあるソフトウェアリンク...

CVE-2021-26121

CS-Cart templates.manage サーバーサイドテンプレートインジェクションによるリモートコード実行の脆弱性 発見者: 360 Vulcan Team の Steven Seeley バージョン: = 4.12.x 最新 日付: 2021-01-08 12:49 CVE: CVE-2021-26121 開示タイムライン 2021-01-26 – CSCart 開発チームに送付 2021-01-27 – CSCart 開発チームから受領通知 2021-02-10 – CSCart からセキュリティバグではないとの回答 2021-02-12 – 一般公開 概要 ショップ管理者...

Sunshine Photo Cart <= 3.2.5 - Reflected Cross-Site Scripting

WP Sunshine Sunshine Photo Cart versions up to 3.2.5 contain a reflected cross-site scripting caused by improper input neutralization during web page generation, letting attackers execute malicious scripts in users' browsers, exploit requires attacker to craft malicious input. id: CVE-2024-43971...

Sunshine Photo Cart <= 3.1.1 - Reflected Cross-Site Scripting

WP Sunshine Sunshine Photo Cart versions up to 3.1.1 contain a cross-site scripting caused by improper neutralization of input during web page generation, letting attackers execute malicious scripts in users' browsers, exploit requires attacker to craft malicious input. id: CVE-2024-30194 info:...

CVE-2025-43990-Magento-RCE

Magento APSB25-94 — 認証なしファイルアップロードによるRCE 概要 REST APIのゲストカート customoptions ファイルアップロードを介して、Magento / Adobe Commerceにおける認証なしファイルアップロードを悪用します。 攻撃チェーン 1. GraphQL → leak product SKU 2. REST API → create guest cart 3. REST API → upload PNG polyshell via customoptions fileinfo 4. HTTP GET → access .php a...

CVE-2026-104119

The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite...

CVE-2024-50968

CVE-2024-50968 説明 イッツソースコード（itsourcecode）Agri-Trading Online Shopping System 1.0 の「カートに追加」機能にビジネスロジックの脆弱性が存在します。これにより、リモート攻撃者は商品をカートに追加する際に quant パラメータを操作できます。数量の値を -0 に設定することで、攻撃者はアプリケーションの合計金額計算ロジックの欠陥を悪用できます。この脆弱性により合計金額がゼロに減少し、攻撃者は商品をカートに追加して、チェックアウトに進むことが可能になります。 脆弱性タイプ ビジネスロジック脆弱性 製品ベンダー...

CVE-2026-104119

The Simple Shopping Cart WordPress plugin, in versions before 5.2.6 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to escape certain settings field values before they are rendered on an admin settings page . This flaw allows high-privilege users, such as admi...

CVE-2026-104119 Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials

The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite...

EUVD-2026-92073

The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite...

WordPress Simple Shopping Cart plugin < 5.2.6 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Simple Shopping Cart versions 5.2.6...

Joomla! Component Saber Cart 1.0.0.12 - Local File Inclusion

A directory traversal vulnerability in the Seber Cart comsebercart component 1.0.0.12 and 1.0.0.13 for Joomla!, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the view parameter to index.php. id: CVE-2010-1313 info: name: Joomla! Component Sab...