4890 matches found
CSRF on update cart functionality
I found a CSRF Vulnerability in the update cart functionality where there is no csrf token being validated While updating the cart as the authenticated user Vulnerable Request: POST /demo/api/updatecart HTTP/1.1 Host: demo.microweber.org Cookie:...
Google Chrome 资源管理错误漏洞
Google Chrome is a web browser from Google, Inc.V8 is one of the open source JavaScript engines. Google Chrome suffers from a resource management error vulnerability that exists due to a use-after-free error in the shopping cart in Google Chrome. A remote attacker could trick a victim into visiti...
WordPress Shopping Cart & eCommerce Store plugin <= 5.2.4 - Arbitrary Design Settings Update via Cross-Site Request Forgery (CSRF) vulnerability
Arbitrary Design Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by WPScanTeam in WordPress Shopping Cart & eCommerce Store plugin versions = 5.2.4. Solution Update the WordPress Shopping Cart & eCommerce Store plugin to the latest available version at least 5.2.5...
WordPress J Cart Upsell and Cross-sell for WooCommerce plugin < 2.0.1 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress J Cart Upsell and Cross-sell for WooCommerce plugin versions 2.0.1. Solution Update the WordPress J Cart Upsell and Cross-sell for WooCommerce plugin to the latest available version at least 2.0.1...
WordPress XT Ajax Add To Cart for WooCommerce plugin <= 1.0.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress XT Ajax Add To Cart for WooCommerce plugin versions = 1.0.3. Solution Update the WordPress XT Ajax Add To Cart for WooCommerce plugin to the latest available version at least 1.0.4...
WordPress Simple Cart plugin <= 1.0.1 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Simple Cart plugin versions = 1.0.1. Solution Update the WordPress Simple Cart plugin to the latest available version at least 1.0.2...
WordPress Sticky add to cart for Woo plugin <= 1.0.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Sticky add to cart for Woo plugin versions = 1.0.2. Solution No patched version available...
WordPress Cart Weight for WooCommerce plugin <= 1.0.7 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Cart Weight for WooCommerce plugin versions = 1.0.7. Solution No patched version available...
WordPress Sticky add to cart for Woo plugin <= 1.0.2 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Sticky add to cart for Woo plugin versions = 1.0.2. Solution No patched version available...
WordPress XT Floating Cart for WooCommerce plugin <= 2.6.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress XT Floating Cart for WooCommerce plugin versions = 2.6.2. Solution Update the WordPress XT Floating Cart for WooCommerce plugin to the latest available version at least 2.6.3...
WordPress Remove Add to Cart Button for WooCommerce plugin <= 1.0.2 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Remove Add to Cart Button for WooCommerce plugin versions = 1.0.2. Solution Update the WordPress Remove Add to Cart Button for WooCommerce plugin to the latest available version at least 1.0.3...
WordPress J Cart Upsell and Cross-sell for WooCommerce plugin < 2.0.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress J Cart Upsell and Cross-sell for WooCommerce plugin versions 2.0.1. Solution Update the WordPress J Cart Upsell and Cross-sell for WooCommerce plugin to the latest available version at least 2.0.1...
WordPress RaCar Clear Cart for WooCommerce plugin <= 1.2.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress RaCar Clear Cart for WooCommerce plugin versions = 1.2.1. Solution No patched version available...
Exposure of Resource to Wrong Sphere in microweber
Exposure of Resource to Wrong Sphere in microweber prior to 1.3 allows users to add deleted products to a cart and buy it...
PT-2022-13418 · Unknown · Microweber
Name of the Vulnerable Software and Affected Versions: microweber versions prior to 1.3 Description: The issue concerns business logic errors and incorrect authorization in the microweber repository. This allows users to add deleted products to a cart and buy them, exposing resources to the wrong...
Business Logic Errors in microweber
Microweber prior to 1.2.11 can suffer from insecure direct object references. A malicious actor can remove items from a victim's cart...
Business Logic Errors
Description I found a IDOR vulnerability where we can able to delete their product in the cart by the id parameter Steps to Produce: First add any product in to the cart and checkout In the checkout page , we can see the cart details and we have functionality to delete the product also I gave the...
S-Cart path traversal vulnerability
S-cart, a Php-based e-commerce management platform from the S-cart community, suffers from a path traversal vulnerability that stems from the failure of a web-based system or product to properly filter special elements in the path of a resource or file. An attacker could exploit the vulnerability...
Directory Traversal
S-Cart is vulnerable to directory traversal. The vulnerability exists due to a lack of sanitization of the input via the download function allowing an attacker to download arbitrary file via the download request...