CVE-2021-32202

CS-Cart 4.11.1 is affected by a cross-site scripting (XSS) vulnerability that can be triggered by manipulating the blog post description field during post creation. The root cause, as described in CNNVD, is insufficient validation/escaping of user input in the post description, enabling copy-past...

CVE-2021-32202

In CS-Cart version 4.11.1, it is possible to induce copy-paste XSS by manipulating the "post description" filed in the blog post creation page...

PT-2021-19674

Name of the Vulnerable Software and Affected Versions: CS-Cart version 4.11.1 Description: The issue allows for copy-paste XSS by manipulating the post description field in the blog post creation page. Recommendations: For CS-Cart version 4.11.1, consider restricting access to the blog post...

CVE-2021-32202: Improper Neutralization of Input During Web Page Generation

In CS-Cart version 4.11.1, it is possible to induce copy-paste XSS by manipulating the "post description" filed in the blog post creation page...

CVE-2021-24620

The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could...

CVE-2021-24620

The CVE-2021-24620 issue affects WordPress Simple Ecommerce Shopping Cart Plugin (versions

CVE-2021-24620: Unrestricted Upload of File with Dangerous Type

The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could...

WordPress plugin code vulnerabilities

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A code issue vulnerability exists in WordPress Simple Ecommerce Shopping Cart, which stems from the...

Cross-Site Request Forgery in express-cart

The express-cart package through 1.1.10 for Node.js allows CSRF...

GHSA-H5Q8-5697-9P9H Cross-Site Request Forgery in express-cart

The express-cart package through 1.1.10 for Node.js allows CSRF...

Hucart CMS Cross-Site Scripting Vulnerabilities

HuCart HuCart is an open source enterprise website building system. a cross-site scripting vulnerability exists in the mestitle field of HuCartCMS version 5.7.4. An attacker can exploit the vulnerability by inserting a malicious script into the title field of the outbox to execute malicious code...

Cross-site Scripting (XSS)

Overview s-cart/core is a free Laravel e-commerce for business. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to missing sanitization in AdminCurrencyController. PoC Login as manager/administrator, then go to Localisation Currencies. When adding or editing...

CVE-2021-34645

The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the savecurrencysettings function found in the /admin/inc/wpeasycartadmininitialsetup.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.1.0...

CVE-2021-34645

The CVE-2021-34645 entry concerns the WordPress plugin “Shopping Cart & eCommerce Store” and a CSRF flaw in the save_currency_settings function (~/admin/inc/wp_easycart_admin_initial_setup.php) affecting versions up to 5.1.0. The vulnerability can inject arbitrary scripts (stored XSS as implied b...

CVE-2021-34645

The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the savecurrencysettings function found in the /admin/inc/wpeasycartadmininitialsetup.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.1.0...

CVE-2021-34645 Shopping Cart & eCommerce Store <= 5.1.0 Cross-Site Request Forgery to Stored Cross-Site Scripting

The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the savecurrencysettings function found in the /admin/inc/wpeasycartadmininitialsetup.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.1.0...

PT-2021-20613

Name of the Vulnerable Software and Affected Versions: The Shopping Cart & eCommerce Store WordPress plugin versions up to and including 5.1.0 Description: The issue is related to Cross-Site Request Forgery, allowing attackers to inject arbitrary web scripts via the save currency settings functio...

CVE-2021-34645: Cross-Site Request Forgery (CSRF)

The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the savecurrencysettings function found in the /admin/inc/wpeasycartadmininitialsetup.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.1.0...

WordPress plugin Shopping Cart & eCommerce Store cross-site request forgeing vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. Cross-site request forgery vulnerability exists in...

WordPress Shopping Cart & eCommerce Store plugin <= 5.1.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability leading to Stored Cross-Site Scripting XSS discovered by Xu-Liang Liao in WordPress Shopping Cart & eCommerce Store plugin versions = 5.1.0. Solution Update the WordPress Shopping Cart & eCommerce Store plugin to the latest available version at least...