Sql injection

The IT-Recht Kanzlei plugin in Zen Cart 1.5.6c German edition allows itrk-api.php rechtstextlanguage SQL Injection...

CVE-2020-6578

Zen Cart 1.5.6d allows reflected XSS via the mainpage parameter to includes/templates/templatedefault/common/tplmainpage.php or includes/templates/responsiveclassic/common/tplmainpage.php...

CVE-2020-6578

Zen Cart 1.5.6d allows reflected XSS via the mainpage parameter to includes/templates/templatedefault/common/tplmainpage.php or includes/templates/responsiveclassic/common/tplmainpage.php...

CVE-2020-6578

CVE-2020-6578 affects Zen Cart 1.5.6d and enables a reflected XSS via the main_page parameter in tpl_main_page.php (two paths: includes/templates/template_default/common/tpl_main_page.php and includes/templates/responsive_classic/common/tpl_main_page.php). Connected sources confirm the vulnerable...

CVE-2020-6577

CVE-2020-6577 affects Zen Cart 1.5.6c (German edition) via the IT-Recht Kanzlei plugin. The itrk-api.php rechtst_text_language parameter enables SQL Injection, allowing a remote attacker to execute arbitrary SQL commands on the affected system. The connected sources confirm the vulnerability exis...

CVE-2020-6577

The IT-Recht Kanzlei plugin in Zen Cart 1.5.6c German edition allows itrk-api.php rechtstextlanguage SQL Injection...

PT-2021-12496

Name of the Vulnerable Software and Affected Versions: Zen Cart version 1.5.6d Description: The issue allows reflected XSS via the main page parameter to files such as includes/templates/template default/common/tpl main page.php or includes/templates/responsive classic/common/tpl main page.php...

CVE-2020-6578: Improper Neutralization of Input During Web Page Generation

Zen Cart 1.5.6d allows reflected XSS via the mainpage parameter to includes/templates/templatedefault/common/tplmainpage.php or includes/templates/responsiveclassic/common/tplmainpage.php...

CVE-2020-6577: Improper Neutralization of Special Elements used in an SQL Command

The IT-Recht Kanzlei plugin in Zen Cart 1.5.6c German edition allows itrk-api.php rechtstextlanguage SQL Injection...

PT-2021-12495

Name of the Vulnerable Software and Affected Versions: Zen Cart version 1.5.6c Description: The issue concerns a SQL Injection vulnerability in the IT-Recht Kanzlei plugin. Specifically, the itrk-api.php endpoint is affected, allowing SQL Injection through the rechtstext language parameter...

Zen Ventures Zen Cart SQL注入漏洞

Zen Cart is an open source, free shopping mall system , used to build a professional online store . An itrk-api.php rechtstextlanguage SQL injection vulnerability exists in the IT-Recht Kanzlei plugin in Zen Cart 1.5.6c. No details of the vulnerability are provided at this time...

Zen Ventures Zen Cart 跨站脚本漏洞

Zen Cart is open source, free mall system for building professional online stores. A reflective cross-site scripting vulnerability exists in Zen Cart 1.5.6d. An attacker can execute malicious script via the includes/templates/templatedefault/common/tplmainpage.php or...

CVE-2020-29045

The food-and-drink-menu plugin through 2.2.0 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the fdmcart cookie in loadcartfromcookie in includes/class-cart-manager.php...

Information disclosure

The food-and-drink-menu plugin through 2.2.0 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the fdmcart cookie in loadcartfromcookie in includes/class-cart-manager.php...

PT-2021-11641

Name of the Vulnerable Software and Affected Versions: food-and-drink-menu plugin through 2.2.0 for WordPress Description: The issue allows remote attackers to execute arbitrary code because of an unserialize operation on the fdm cart cookie in load cart from cookie in...

CVE-2020-29045: Deserialization of Untrusted Data

The food-and-drink-menu plugin through 2.2.0 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the fdmcart cookie in loadcartfromcookie in includes/class-cart-manager.php...

Zen Cart 1.5.7b - Remote Code Execution (Authenticated)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework This exploit write payload in database and trig to command a bug in an zencart v1.5.7b web application class MetasploitModule 'zencart authenticated remote code executio...

WordPress Abandoned Cart Lite for WooCommerce plugin <= 5.8.5 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by NintechNet in WordPress Abandoned Cart Lite for WooCommerce plugin versions = 5.8.5. Solution Update the WordPress Abandoned Cart Lite for WooCommerce plugin to the latest available version at least 5.8.6...

CVE-2021-3120

An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress allows remote attackers to achieve remote code execution on the operating system in the security context of the web server. In order to exploit this vulnerability, an attacker must ...

CVE-2021-3120

An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress allows remote attackers to achieve remote code execution on the operating system in the security context of the web server. In order to exploit this vulnerability, an attacker must ...