Inquiry Cart <= 3.4.2 - Stored XSS via CSRF

Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack PoC Make a logged in admin open an HTML file containing:...

WordPress Inquiry Cart Plugin <= 3.4.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Inquiry Cart Type Plugin Vulnerable versions = 3.4.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-5155 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 9f7960eccdf7 Credits Bob Matyas Required...

Inquiry Cart <= 3.4.2 - Stored XSS via CSRF

Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Make a logged in admin open an HTML file containing: alert9995'...

WordPress PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode plugin <= 1.7 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Benedictus Jovan aillesiM in WordPress Plugin PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode versions = 1.7...

CVE-2024-3065

CVE-2024-3065 concerns the PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode plugin for WordPress. The description states it is vulnerable to Stored Cross-Site Scripting in all versions up to and including 1.7 due to insufficient input sanitization and output escaping. The vulnerabilit...

WordPress plugin PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode 安全漏洞

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in the WordPress plugin PayPal Pay Now, Buy Now, Donation...

PT-2024-27078 · WordPress · Build App Online

Name of the Vulnerable Software and Affected Versions: Build App Online plugin for WordPress versions up to, and including, 1.0.21 Description: The issue is due to missing authentication checking in the set user cart function with the user id header value, allowing unauthenticated attackers to lo...

CVE-2024-4826

SQL injection vulnerability in Simple PHP Shopping Cart affecting version 0.9. This vulnerability could allow an attacker to retrieve all the information stored in the database by sending a specially crafted SQL query, due to the lack of proper sanitisation of the categoryid parameter in the...

CVE-2024-4826

CVE-2024-4826 : SQL injection in the open-source PHP Shopping Cart (version 0.9) due to improper sanitisation of the category_id parameter in category.php. The issue enables an attacker to exfiltrate data from the database. CVSS metrics in the sources show a CRITICAL impact (CVSS v3.1/AV:N/AC:L/P...

CVE-2024-4826 SQL injection vulnerability in Simple PHP Shopping Cart

SQL injection vulnerability in Simple PHP Shopping Cart affecting version 0.9. This vulnerability could allow an attacker to retrieve all the information stored in the database by sending a specially crafted SQL query, due to the lack of proper sanitisation of the categoryid parameter in the...

CVE-2024-4826 SQL injection vulnerability in Simple PHP Shopping Cart

SQL injection vulnerability in Simple PHP Shopping Cart affecting version 0.9. This vulnerability could allow an attacker to retrieve all the information stored in the database by sending a specially crafted SQL query, due to the lack of proper sanitisation of the categoryid parameter in the...

PHP Shopping Cart SQL注入漏洞

PHP Shopping Cart is an open source shopping cart system by Phpjabbers. PHP Shopping Cart version 0.9 suffers from a SQL injection vulnerability that stems from the presence of a SQL injection vulnerability that allows an attacker to retrieve all information stored in the database by sending a...

CVE-2024-4213

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.6.4 via the order report functionality. This makes it possible for unauthenticated attackers to extract sensitive data including order details such as...

CVE-2024-4213

CVE-2024-4213 concerns the WordPress plugin Shopping Cart & eCommerce Store (WP-EasyCart). The vulnerability is a case of Sensitive Information Exposure via the plugin’s order report functionality in all versions up to 5.6.4, allowing unauthenticated attackers to extract order details and other P...

Sunshine Photo Cart: Free Client Photo Galleries for Photographers < 3.1.2 - Unauthenticated PHP Object Injection

Description The Sunshine Photo Cart: Free Client Photo Galleries for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP...

PT-2024-25179 · Digincube · Mdgiftproduct

Name of the Vulnerable Software and Affected Versions: Digincube mdgiftproduct versions prior to 1.4.1 Description: The issue allows an attacker to run arbitrary SQL commands via the MdGiftRule::addGiftToCart method. This enables the execution of unauthorized database queries, potentially leading...

WordPress Shopping Cart & eCommerce Store plugin <= 5.6.3 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Krzysztof Zając in WordPress Plugin WP EasyCart versions = 5.6.3...

CVE-2024-32452 WordPress Shopping Cart & eCommerce Store plugin <= 5.5.19 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in WP EasyCart.This issue affects WP EasyCart: from n/a through 5.5.19...

WordPress Plugin Shopping Cart & eCommerce Store 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. WordPress Plugin Shopping Cart & eCommerce Store A...

CVE-2024-3211

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to SQL Injection via the 'productid' attribute of the ecaddtocart shortcode in all versions up to, and including, 5.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...