CVE-2017-10667

Zen Cart 1.6.0 is affected by a cross-site scripting (XSS) vulnerability in index.php where the products_id parameter can be used to inject script. The provided documents confirm the issue but do not include exploitation details, affected versions beyond Zen Cart 1.6.0, or specific root-cause cod...

pw.org XSS vulnerability

Vulnerable URL: https://www.pw.org/cart/index.php?camefrom=1/-///'/"//--...

SQL Injection Vulnerability in the cartSettlement Method of ShopSn V2.0 Mall System

ShopsN Mall system is a product of Shanghai Yiso Network Technology Co., Ltd, an enterprise-class commercial standard full-featured allow free commercial use of open source online store full network system. A SQL injection vulnerability exists in the cartid parameter in the cartSettlement method ...

ninestarsusa.com XSS vulnerability

Vulnerable URL: https://www.ninestarsusa.com/secure-html/ShoppingCartStep01.asp?RegistrationProcess=YesShop=1/-///'/"//--...

eCom Cart SQL Injection Vulnerability

A SQL injection vulnerability exists in eCom Cart. The vulnerability allows attackers to obtain sensitive information about the database...

eCom Cart 1.3 SQL Injection

Exploit Title: eCom Cart 1.3 Exploit Google Dork: inurl:"/pdetails/11" 11 is variable Date: 10.06.2017 Exploit Author: Alperen Eymen Ozcan & Batuhan Camci Vendor Homepage: https://codecanyon.net/item/ecom-cart-a-php-shopping-cart-with-blog/13731007 Software Link:...

iranplanner.com XSS vulnerability

Vulnerable URL: https://www.iranplanner.com/cart?action=lodgin"...

eCom Cart 1.3 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: eCom Cart 1.3 Exploit Google Dork: inurl:"/pdetails/11" 11 is variable Date: 10.06.2017 Exploit Author: Alperen Eymen Ozcan & Batuhan Camci Vendor Homepage:...

PaulShop - SQL Injection

PaulShop - SQL Injection Exploit Title: PaulShop CMS = 2017-03-25 Sql Injection Date: 10-06-2017 Exploit Author: Se0pHpHack3r Vendor Homepage: https://codecanyon.net/item/paulshop-cms-with-shopping-cart-system/18070714 Version: 2017-03-25 1. Description SQL Injection on Shipping Cost page in Cart...

eCom Cart 1.3 - SQL Injection

eCom Cart 1.3 - SQL Injection Exploit Title: eCom Cart 1.3 Exploit Google Dork: inurl:"/pdetails/11" 11 is variable Date: 10.06.2017 Exploit Author: Alperen Eymen Ozcan & Batuhan Camci Vendor Homepage: https://codecanyon.net/item/ecom-cart-a-php-shopping-cart-with-blog/13731007 Software Link:...

eCom Cart 1.3 - SQL Injection

Exploit Title: eCom Cart 1.3 Exploit Google Dork: inurl:"/pdetails/11" 11 is variable Date: 10.06.2017 Exploit Author: Alperen Eymen Ozcan & Batuhan Camci Vendor Homepage: https://codecanyon.net/item/ecom-cart-a-php-shopping-cart-with-blog/13731007 Software Link:...

Starbucks: Missing CSRF Token On Remove Coupun From Cart

Hi, When remove coupun, there's no CSRF token, at this time i use ███████ Coupun to reproduce it. Vuln Request POST /on/demandware.store/Sites-Teavana-Site/default/Cart-RemoveCoupon HTTP/1.1 Host: www.teavana.com User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64; rv:53.0 Gecko/20100101 Firefox/53.0...

Zen Cart Cross-Site Scripting Vulnerability (CNVD-2017-08298)

Zen Cart is an open source shopping cart system developed by Zen Cart team. The system is mainly used to establish an online store , can support a variety of payment methods , multi-language options , online shopping mall batch update and so on. A cross-site scripting vulnerability exists in the...

CVE-2017-8833

Zen Cart 1.6.0 has XSS in the mainpage parameter to index.php. NOTE: 1.6.0 is not an official release but the vendor's README.md file offers a link to v160.zip with a description of "Download latest in-development version from github."...

CVE-2017-8833

Zen Cart 1.6.0 has XSS in the mainpage parameter to index.php. NOTE: 1.6.0 is not an official release but the vendor's README.md file offers a link to v160.zip with a description of "Download latest in-development version from github."...

Design/Logic Flaw

Zen Cart 1.6.0 has XSS in the mainpage parameter to index.php. NOTE: 1.6.0 is not an official release but the vendor's README.md file offers a link to v160.zip with a description of "Download latest in-development version from github."...

CVE-2017-8833

Zen Cart 1.6.0 (development version) contains a cross-site scripting (XSS) flaw in the main_page parameter of index.php. The vulnerability stems from insufficient sanitization of input to the main_page parameter, allowing injection of arbitrary script/HTML. Public references indicate 1.6.0 is in-...

CVE-2017-8833

Zen Cart 1.6.0 has XSS in the mainpage parameter to index.php. NOTE: 1.6.0 is not an official release but the vendor's README.md file offers a link to v160.zip with a description of "Download latest in-development version from github."...

CVE-2017-8833

Zen Cart 1.6.0 has XSS in the mainpage parameter to index.php. NOTE: 1.6.0 is not an official release but the vendor's README.md file offers a link to v160.zip with a description of "Download latest in-development version from github."...

PT-2017-18564

Name of the Vulnerable Software and Affected Versions Zen Cart version 1.6.0 Description The issue concerns an XSS vulnerability in the main page parameter to the "index.php" endpoint. This allows for potential exploitation through malicious input. Recommendations For Zen Cart version 1.6.0, as a...