CVE-2026-24994

Sunshine Photo Cart (WordPress plugin) has a Missing Authorization/Broken Access Control vulnerability affecting versions up to and including 3.5.7.2. The issue stems from incorrectly configured access control security levels, allowing exploitation without authentication. Remediation: upgrade Sun...

CVE-2026-24994

Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through = 3.5.7.2...

CVE-2026-24994 WordPress Sunshine Photo Cart plugin <= 3.5.7.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through = 3.5.7.2...

WordPress plugin Sunshine Photo Cart 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

Fishing Reservation System SQL注入漏洞

The Fishing Reservation System is a fishing reservation system developed by Fishing Reservation Company. Version 7.5 of the Fishing Reservation System has a SQL injection vulnerability. This vulnerability stems from multiple remote SQL injection vulnerabilities present in the admin.php, cart.php,...

PT-2026-6239

Name of the Vulnerable Software and Affected Versions Sunshine Photo Cart versions through 3.5.7.2 Description An authorization issue exists in Sunshine Photo Cart that allows exploitation of incorrectly configured access control security levels. Recommendations Update Sunshine Photo Cart to a...

PT-2026-5831

Fishing Reservation System 7.5 contains multiple remote SQL injection vulnerabilities in admin.php, cart.php, and calendar.php that allow attackers to inject malicious SQL commands. Attackers can exploit vulnerable parameters like uid, pid, type, m, y, and code to compromise the database manageme...

CVE-2021-47856

Easy Cart Shopping Cart 2021 contains a non-persistent cross-site scripting vulnerability in the search module's keyword parameter. Remote attackers can inject malicious script code through the search input to compromise user sessions and manipulate application content...

CVE-2021-47909

Mult-E-Cart Ultimate 2.4 contains multiple SQL injection vulnerabilities in inventory, customer, vendor, and order modules. Remote attackers with privileged vendor or admin roles can exploit the 'id' parameter to execute malicious SQL commands and compromise the database management system...

CVE-2021-47909

Mult-E-Cart Ultimate 2.4 contains multiple SQL injection vulnerabilities in inventory, customer, vendor, and order modules. Remote attackers with privileged vendor or admin roles can exploit the 'id' parameter to execute malicious SQL commands and compromise the database management system...

CVE-2021-47909

CVE-2021-47909 concerns Mult-E-Cart Ultimate 2.4, with multiple SQL injection flaws in the inventory, customer, vendor, and order modules. The underlying issue is injectable SQL via the vulnerable id parameter, which remote attackers with vendor/admin privileges could exploit to run arbitrary SQL...

EUVD-2021-34761

Mult-E-Cart Ultimate 2.4 contains multiple SQL injection vulnerabilities in inventory, customer, vendor, and order modules. Remote attackers with privileged vendor or admin roles can exploit the 'id' parameter to execute malicious SQL commands and compromise the database management system...

CVE-2021-47909 Mult-E-Cart Ultimate 2.4 SQL Injection via Vulnerable ID Parameters

Mult-E-Cart Ultimate 2.4 contains multiple SQL injection vulnerabilities in inventory, customer, vendor, and order modules. Remote attackers with privileged vendor or admin roles can exploit the 'id' parameter to execute malicious SQL commands and compromise the database management system...

CVE-2021-47909 Mult-E-Cart Ultimate 2.4 SQL Injection via Vulnerable ID Parameters

Mult-E-Cart Ultimate 2.4 contains multiple SQL injection vulnerabilities in inventory, customer, vendor, and order modules. Remote attackers with privileged vendor or admin roles can exploit the 'id' parameter to execute malicious SQL commands and compromise the database management system...

CVE-2021-47856

Easy Cart Shopping Cart 2021 contains a non-persistent cross-site scripting vulnerability in the search module's keyword parameter. Remote attackers can inject malicious script code through the search input to compromise user sessions and manipulate application content...

CVE-2021-47856

CVE-2021-47856 affects Easy Cart Shopping Cart 2021, with a non-persistent cross-site scripting flaw in the search module’s keyword parameter. The underlying issue is XSS in the search input that can expose or manipulate user sessions and content. A PoC exploit is indicated in connected data, but...

Mult-E-Cart Ultimate SQL注入漏洞

Mult-E-Cart Ultimate is an e-commerce platform script developed by the Indian company Mult-E-Cart. Version 2.4 of Mult-E-Cart Ultimate contains a SQL injection vulnerability. This vulnerability stems from multiple SQL injection vulnerabilities present in the inventory, customer, supplier, and ord...

NetArt Media Easy Cart Shopping Cart 跨站脚本漏洞

NetArt Media Easy Cart Shopping Cart is a lightweight PHP e-commerce shopping system developed by NetArt Media in Bulgaria. The 2021 version of NetArt Media Easy Cart Shopping Cart contains a cross-site scripting vulnerability. This vulnerability stems from the non-persistent cross-site scripting...

WordPress PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode plugin <= 1.7 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode versions = 1.7...

CVE-2026-1600

The vulnerability CVE-2026-1600 affects Bdtask Bhojon All-In-One Restaurant Management System (up to 20260116). The issue resides in the Add-to-Cart Submission Endpoint, specifically an unknown function in the /hungry/addtocart path, where manipulating the argument price/allprice causes business ...