JVN#88804335: WordPress Plugin "Personalized WooCommerce Cart Page” vulnerable to cross-site request forgery

WordPress Plugin "Personalized WooCommerce Cart Page” provided by N-MEDIA contains a cross-site request forgery vulnerability CWE-352. Impact If a user views a malicious page while logged in, unintended operations may be performed. Solution Update the plugin Update the plugin according to the...

WordPress Personalized WooCommerce Cart Page Plugin Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Personalized WooCommerce Cart Page plugin is a plugin for adding text to WooCommerce pages. The platform supports personalized blog sit...

Personalized WooCommerce Cart Page <= 2.4 - Cross-Site Request Forgery (CSRF)

The WooHero WooCommerce Store Customizer WordPress plugin was affected by a Cross-Site Request Forgery CSRF security vulnerability...

Wordpress Plugin Simple-e-commerce-shopping-cart DatabaseSQL Information Disclosure Vulnerability

WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. An information disclosure vulnerability exists in the Wordpress plugin...

X-Cart Cross-Site Scripting Vulnerability (CNVD-2019-17133)

X-Cart is an open source e-commerce platform. A cross-site scripting vulnerability exists in X-Cart version V5. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

CVE-2019-7220

X-Cart V5 is vulnerable to XSS via the CategoryFilter2 parameter...

CVE-2019-7220

X-Cart V5 is vulnerable to XSS via the CategoryFilter2 parameter...

Design/Logic Flaw

X-Cart V5 is vulnerable to XSS via the CategoryFilter2 parameter...

CVE-2019-7220

CVE-2019-7220 affects X-Cart V5, where a cross-site scripting (XSS) vulnerability is exposed through the CategoryFilter2 parameter. The connected documents consistently describe X-Cart V5 as vulnerable to XSS via this parameter, indicating a flaw in input handling/validation that allows injection...

CVE-2019-7220

X-Cart V5 is vulnerable to XSS via the CategoryFilter2 parameter...

CVE-2019-7220: Improper Neutralization of Input During Web Page Generation

X-Cart V5 is vulnerable to XSS via the CategoryFilter2 parameter...

PT-2019-18472

Name of the Vulnerable Software and Affected Versions X-Cart V5 affected versions not specified Description The issue allows for XSS via the CategoryFilter2 parameter. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

Duplicate Advisory: Privilege Escalation in express-cart

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hr89-w7p6-pjmq. This link is maintained to preserve external references. Original Description Versions of express-cart before 1.1.6 are vulnerable to privilege escalation. This vulnerability can be exploited so...

PT-2019-19995

Name of the Vulnerable Software and Affected Versions express-cart versions prior to 1.1.6 Description The issue allows normal users to escalate their privileges, enabling them to add new administrator users. Recommendations Update to version 1.1.6 or later...

RSEvents! Pro Cart Plugin older than 1.1.15 ,Other

RSEvents! Pro Cart Plugin older than 1.1.15,Other UpdateNotice URL https://www.rsjoomla.com/blog/view/468-csv-vulnerability-explained.html...

CVE-2019-2652

Vulnerability in the Oracle iStore component of Oracle E-Business Suite subcomponent: Shopping Cart. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network...

CVE-2019-2652: Undefined Security Weakness

Vulnerability in the Oracle iStore component of Oracle E-Business Suite subcomponent: Shopping Cart. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network...

TomTom: CSRF allows attacker to manage customer's shopping cart.

The following endpoint https://www.tomtom.com:443/enus/store/basket-add.html had no CSRF checks / tokens .. whatsoever , which allows a malicious user add massive amounts of a any product to a victim's cart or empty the cart. the CSRF POC file included adds 50 items of the giving product the a...

Ashop Shopping Cart Software - 'bannedcustomers.php?blacklistitemid' SQL Injection

Exploit Title: Ashop Shopping Cart Software - SQL Injection Date: 08.04.2019 Exploit Author: Doğukan Karaciğer Vendor Homepage: http://www.ashopsoftware.com Software Link: https://sourceforge.net/projects/ashop/ Demo Site: http://demo.ashopsoftware.com/ Version: Lastest Tested on: Ubuntu-trusty-6...

Ashop Shopping Cart Software - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Ashop Shopping Cart Software - SQL Injection Exploit Author: Doğukan Karaciğer Vendor Homepage: http://www.ashopsoftware.com Software Link: https://sourceforge.net/projects/ashop/ Demo Site: http://demo.ashopsoftware.com/ Versio...