Remote code execution

X-Cart 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 is vulnerable to Remote Code Execution. This vulnerability exists because the application fails to check remote file extensions before saving locally. This vulnerability can be exploited by anyone with Vendor access or higher. One attack methodology is ...

CVE-2017-15285

X-Cart 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 is vulnerable to Remote Code Execution. This vulnerability exists because the application fails to check remote file extensions before saving locally. This vulnerability can be exploited by anyone with Vendor access or higher. One attack methodology is ...

CVE-2017-15285

X-Cart 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 is vulnerable to Remote Code Execution. This vulnerability exists because the application fails to check remote file extensions before saving locally. This vulnerability can be exploited by anyone with Vendor access or higher. One attack methodology is ...

CVE-2017-15285

X-Cart 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 are vulnerable to Remote Code Execution due to improper validation of uploaded file extensions before saving locally. The issue can be exploited by anyone with Vendor access or higher by uploading an image file in a product catalog attachment, then uplo...

CVE-2017-15285

X-Cart 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 is vulnerable to Remote Code Execution. This vulnerability exists because the application fails to check remote file extensions before saving locally. This vulnerability can be exploited by anyone with Vendor access or higher. One attack methodology is ...

PT-2017-13967

Name of the Vulnerable Software and Affected Versions X-Cart versions 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 Description The issue exists due to the application's failure to check remote file extensions before saving them locally, allowing for Remote Code Execution. This can be exploited by users...

CVE-2017-15285: Improper Input Validation

X-Cart 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 is vulnerable to Remote Code Execution. This vulnerability exists because the application fails to check remote file extensions before saving locally. This vulnerability can be exploited by anyone with Vendor access or higher. One attack methodology is ...

X-Cart Remote Code Execution Vulnerability

X-Cart is e-commerce PHP shopping cart software. X-Cart suffers from a remote code execution vulnerability due to the application failing to check remote file extensions before saving locally. An attacker could exploit the vulnerability to gain vendor access or higher privileges...

slgslg.com XSS vulnerability

Vulnerable URL: http://slgslg.com/tw/shoppingcart2/cartimg.php?imgname=%22/%3E%3Cscript%3Ealert/OPENBUGBOUNTY/;%3C/script%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 08.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown ...

MarketPress <= 3.2.6 - PHP Object Injection

The MarketPress plugin installs to a directory named wordpress-ecommerce versions 3.2.6 and prior are vulnerable to a PHP Object Injection attack from the cart cookie value stored in connection with this plugin. Send an object to the site using the mpglobalcart cookie value and it will be...

CVE-2015-8352

Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the act parameter to ajax.php...

Directory traversal

Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the act parameter to ajax.php...

CVE-2015-8352

CVE-2015-8352 affects Zen Cart 1.5.4 and is a Local File Inclusion vulnerability triggered by directory traversal in the Ajax endpoint. The flaw occurs in the /ajax.php act parameter processing, allowing remote, unauthenticated attackers to include and execute arbitrary local PHP files, potential...

CVE-2015-8352

Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the act parameter to ajax.php...

CVE-2015-8352: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the act parameter to ajax.php...

PT-2017-7401

Name of the Vulnerable Software and Affected Versions Zen Cart version 1.5.4 Description A directory traversal issue allows remote attackers to include and execute arbitrary local files. This is achieved by using a .. dot dot in the act parameter to the "ajax.php" endpoint. Recommendations For Ze...

CVE-2017-12984

PHPMyWind 5.3 has XSS in shoppingcart.php, related to message.php, admin/message.php, and admin/messageupdate.php...

CVE-2017-12984

PHPMyWind 5.3 has XSS in shoppingcart.php, related to message.php, admin/message.php, and admin/messageupdate.php...

CVE-2017-12984

PHPMyWind 5.3 has XSS in shoppingcart.php, related to message.php, admin/message.php, and admin/messageupdate.php...

CVE-2017-10192

Vulnerability in the Oracle iStore component of Oracle E-Business Suite subcomponent: Shopping Cart. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...