WordPress WP Menu Cart plugin <= 2.11.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered in WordPress WP Menu Cart plugin versions = 2.11.0. Solution Update the WordPress WP Menu Cart plugin to the latest available version at least 2.12.0...

GHSA-94WQ-87G6-8H77 Magento Open Source allows Cross-Site Request Forgery (CSRF)

Adobe Commerce versions 2.4.2-p2 and earlier, 2.4.3 and earlier and 2.3.7p1 and earlier are affected by a cross-site request forgery CSRF vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to a customer's cart by an unauthenticated attacker. Acces...

Reflected XSS in Zen Cart before 1.5.7a

Zen Cart 1.5.6d allows reflected XSS via the mainpage parameter to includes/templates/templatedefault/common/tplmainpage.php or includes/templates/responsiveclassic/common/tplmainpage.php...

GHSA-WXXX-2X6V-979F Reflected XSS in Zen Cart before 1.5.7a

Zen Cart 1.5.6d allows reflected XSS via the mainpage parameter to includes/templates/templatedefault/common/tplmainpage.php or includes/templates/responsiveclassic/common/tplmainpage.php...

Zen Cart vulnerable to authenticated remote code execution

Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element within the modules edit page and inserting a command...

GHSA-38F9-4VHQ-9CR8 Zen Cart vulnerable to authenticated remote code execution

Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element within the modules edit page and inserting a command...

GHSA-3J6M-M5V5-9785 OpenCart Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF in CART option in OpenCart Ltd. Opencart CMS 3.0.3.6 allows attacker to add cart items via Add to cart...

OpenCart Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF in CART option in OpenCart Ltd. Opencart CMS 3.0.3.6 allows attacker to add cart items via Add to cart...

GHSA-R728-JWF5-F5R5 Magento Reflected cross-site scripting on customer cart page

A reflected cross-site scripting vulnerability exists on the customer cart checkout page of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by sending a victim a crafted URL that results in malicious javascript execution in the victim's...

Magento Reflected cross-site scripting on customer cart page

A reflected cross-site scripting vulnerability exists on the customer cart checkout page of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by sending a victim a crafted URL that results in malicious javascript execution in the victim's...

Magento 2 Community Edition CSRF Vulnerability

A cross-site request forgery CSRF vulnerability exists in the checkout cart item of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited at the time of editing or configuration...

CVE-2022-24108

The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resulting in the ability to write to files on the server, cause DoS, and achieve remote code execution because of deserialization of untrusted...

GHSA-C9R9-3H38-R7VJ Authenticated RCE in Zen Cart 1.5.5e

The traverseStrictSanitize function in admindir/includes/classes/AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which allows remote authenticated users to execute arbitrary PHP code by placing that code into an invalid array index of the adminname array parameter to...

Authenticated RCE in Zen Cart 1.5.5e

The traverseStrictSanitize function in admindir/includes/classes/AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which allows remote authenticated users to execute arbitrary PHP code by placing that code into an invalid array index of the adminname array parameter to...

CVE-2022-30395

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggersmerch/classes/Master.php?f=deletecart...

CVE-2022-30395

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggersmerch/classes/Master.php?f=deletecart...

GHSA-HR89-W7P6-PJMQ express-cart allows any user to create an admin user

Express-Cart before 1.1.6 allows remote attackers to create an admin user via an /admin/setup Referer header...

express-cart allows any user to create an admin user

Express-Cart before 1.1.6 allows remote attackers to create an admin user via an /admin/setup Referer header...

GHSA-4W62-CQ5R-5MMQ express-cart unrestricted file upload vulnerability

Unrestricted file upload RCE in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine...

express-cart unrestricted file upload vulnerability

Unrestricted file upload RCE in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine...