CVE-2014-125138

C97net qEngine CMS (through 6.0.0), Kemana Directory (through 1.5.6), and Cart Engine (through 3.0.0) are susceptible to an unrestricted file upload vulnerability within administrative image fields. Users with editor-role privileges can exploit the page_image or cat_image parameters to upload PHP...

EUVD-2014-9838

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose...

EUVD-2014-9839

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the pageimage or catimage parameters to the web-accessible /public/image...

CVE-2014-125137

The C97net qEngine CMS (through 6.0.0), Kemana Directory (through 1.5.6), and Cart Engine (through 3.0.0) are vulnerable to a local file inclusion (LFI) vulnerability. The flaw exists in the run parameter of the admin/task.php file. Authenticated administrators can exploit this by providing direc...

CVE-2014-125136

The C97net qEngine CMS (through version 6.0.0), Kemana Directory (through version 1.5.6), and Cart Engine (through version 3.0.0) are affected by an information disclosure vulnerability. The root cause is the exposure of database backups within the web-accessible /admin/backup directory. Unauthen...

EUVD-2014-9837

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess date-based names...

EUVD-2014-8148

Malware in sbrugna...

EUVD-2014-8146

Malware in sbrugna...

EUVD-2014-8147

Malware in sbrugna...

CVE-2014-8307

Multiple cross-site scripting XSS vulnerabilities in skins/default/outline.tpl in C97net Cart Engine before 4.0 allow remote attackers to inject arbitrary web script or HTML via the 1 path parameter in the "drop down TOP menu with path" section or 2 printthispage variable in the footercontentbloc...

CVE-2014-8305

Open redirect vulnerability in the redir function in includes/function.php in C97net Cart Engine before 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the HTTP Referer header to 1 index.php, 2 cart.php, 3 msg.php, or 4 page.php...

CVE-2014-8306

SQL injection vulnerability in the sqlquery function in cart.php in C97net Cart Engine before 4.0 allows remote attackers to execute arbitrary SQL commands via the itemid variable, as demonstrated by the 1 itemid0 or 2 itemid parameter...

Cart Engine 7.0.0 Build 20180202 Database Disclosure

============================================================================================================================ | Title : Cart Engine Version: 7.0.0 build 20180202 Database Disclosure Vulnerability | | Author : indoushka | | Telegram : @indoushka | | Tested on : Win 10 X64 /FrPro | |...

Cart Engine 3.0 SQL Injection

SQL Injection vulnerabilty in Cart Engine cart.php Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

CVE-2014-8306

SQL injection vulnerability in the sqlquery function in cart.php in C97net Cart Engine before 4.0 allows remote attackers to execute arbitrary SQL commands via the itemid variable, as demonstrated by the 1 itemid0 or 2 itemid parameter...

CVE-2014-8305

Open redirect vulnerability in the redir function in includes/function.php in C97net Cart Engine before 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the HTTP Referer header to 1 index.php, 2 cart.php, 3 msg.php, or 4 page.php...

CVE-2014-8307

Multiple cross-site scripting XSS vulnerabilities in skins/default/outline.tpl in C97net Cart Engine before 4.0 allow remote attackers to inject arbitrary web script or HTML via the 1 path parameter in the "drop down TOP menu with path" section or 2 printthispage variable in the footercontentbloc...

Open redirect

Open redirect vulnerability in the redir function in includes/function.php in C97net Cart Engine before 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the HTTP Referer header to 1 index.php, 2 cart.php, 3 msg.php, or 4 page.php...

Sql injection

SQL injection vulnerability in the sqlquery function in cart.php in C97net Cart Engine before 4.0 allows remote attackers to execute arbitrary SQL commands via the itemid variable, as demonstrated by the 1 itemid0 or 2 itemid parameter...

CVE-2014-8305

Open redirect vulnerability in the redir function in includes/function.php in C97net Cart Engine before 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the HTTP Referer header to 1 index.php, 2 cart.php, 3 msg.php, or 4 page.php...