CVE-2021-32172

Maian Cart v3.8 contains a preauthorization remote code execution RCE exploit via a broken access control issue in the Elfinder plugin...

Maian Script World Maian Cart 安全漏洞

Maian Script World Maian Cart is a powerful e-commerce system from Maian Script World, UK. A security vulnerability exists in Maian Cart v3.8, which stems from an access control issue in the Elfinder plugin...

TheCartPress eCommerce Shopping Cart <= 1.5.3.6 - Unauthenticated Arbitrary Admin Account Creation

The tcpregisterandloginajax AJAX action of the plugin allows unauthenticated users to create accounts with an arbitrary role such as admin POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-GB,en;q=0.5...

WordPress Floating Cart plugin <= 1.2.1 - Multiple vulnerabilities

Multiple vulnerabilities Authenticated Arbitrary WordPress Options Change, Read and Deletion / Authenticated User Enumeration / Authenticated Plugin Settings Change, Import and Export were discovered by Jerome Bruandet NinTechNet in WordPress Floating Cart plugin versions = 1.2.1. Solution Update...

CVE-2021-32202

In CS-Cart version 4.11.1, it is possible to induce copy-paste XSS by manipulating the "post description" filed in the blog post creation page...

CVE-2021-32202

In CS-Cart version 4.11.1, it is possible to induce copy-paste XSS by manipulating the "post description" filed in the blog post creation page...

Code injection

In CS-Cart version 4.11.1, it is possible to induce copy-paste XSS by manipulating the "post description" filed in the blog post creation page...

CVE-2021-32202

In CS-Cart version 4.11.1, it is possible to induce copy-paste XSS by manipulating the "post description" filed in the blog post creation page...

CVE-2021-32202

In CS-Cart version 4.11.1, it is possible to induce copy-paste XSS by manipulating the "post description" filed in the blog post creation page...

CVE-2021-32202

CS-Cart 4.11.1 is affected by a cross-site scripting (XSS) vulnerability that can be triggered by manipulating the blog post description field during post creation. The root cause, as described in CNNVD, is insufficient validation/escaping of user input in the post description, enabling copy-past...

CVE-2021-24620

The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could...

CVE-2021-24620

The CVE-2021-24620 issue affects WordPress Simple Ecommerce Shopping Cart Plugin (versions

WordPress 插件代码问题漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A code issue vulnerability exists in WordPress Simple Ecommerce Shopping Cart, which stems from the...

GHSA-H5Q8-5697-9P9H Cross-Site Request Forgery in express-cart

The express-cart package through 1.1.10 for Node.js allows CSRF...

Cross-Site Request Forgery in express-cart

The express-cart package through 1.1.10 for Node.js allows CSRF...

Hucart CMS 跨站脚本漏洞

HuCart HuCart is an open source enterprise website building system. a cross-site scripting vulnerability exists in the mestitle field of HuCartCMS version 5.7.4. An attacker can exploit the vulnerability by inserting a malicious script into the title field of the outbox to execute malicious code...

Cross-site Scripting (XSS)

Overview s-cart/core is a free Laravel e-commerce for business. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to missing sanitization in AdminCurrencyController. PoC Login as manager/administrator, then go to Localisation Currencies. When adding or editing...

CVE-2021-34645

The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the savecurrencysettings function found in the /admin/inc/wpeasycartadmininitialsetup.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.1.0...

CVE-2021-34645 Shopping Cart & eCommerce Store <= 5.1.0 Cross-Site Request Forgery to Stored Cross-Site Scripting

The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the savecurrencysettings function found in the /admin/inc/wpeasycartadmininitialsetup.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.1.0...

CVE-2021-34645

The CVE-2021-34645 entry concerns the WordPress plugin “Shopping Cart & eCommerce Store” and a CSRF flaw in the save_currency_settings function (~/admin/inc/wp_easycart_admin_initial_setup.php) affecting versions up to 5.1.0. The vulnerability can inject arbitrary scripts (stored XSS as implied b...