4890 matches found
Cross-Site Request Forgery in express-cart
The express-cart package through 1.1.10 for Node.js allows CSRF...
Hucart CMS 跨站脚本漏洞
HuCart HuCart is an open source enterprise website building system. a cross-site scripting vulnerability exists in the mestitle field of HuCartCMS version 5.7.4. An attacker can exploit the vulnerability by inserting a malicious script into the title field of the outbox to execute malicious code...
Cross-site Scripting (XSS)
Overview s-cart/core is a free Laravel e-commerce for business. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to missing sanitization in AdminCurrencyController. PoC Login as manager/administrator, then go to Localisation Currencies. When adding or editing...
CVE-2021-34645
The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the savecurrencysettings function found in the /admin/inc/wpeasycartadmininitialsetup.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.1.0...
CVE-2021-34645 Shopping Cart & eCommerce Store <= 5.1.0 Cross-Site Request Forgery to Stored Cross-Site Scripting
The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the savecurrencysettings function found in the /admin/inc/wpeasycartadmininitialsetup.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.1.0...
CVE-2021-34645
The CVE-2021-34645 entry concerns the WordPress plugin “Shopping Cart & eCommerce Store” and a CSRF flaw in the save_currency_settings function (~/admin/inc/wp_easycart_admin_initial_setup.php) affecting versions up to 5.1.0. The vulnerability can inject arbitrary scripts (stored XSS as implied b...
WordPress plugin Shopping Cart & eCommerce Store 跨站请求伪造漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. Cross-site request forgery vulnerability exists in...
WordPress Shopping Cart & eCommerce Store plugin <= 5.1.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)
Cross-Site Request Forgery CSRF vulnerability leading to Stored Cross-Site Scripting XSS discovered by Xu-Liang Liao in WordPress Shopping Cart & eCommerce Store plugin versions = 5.1.0. Solution Update the WordPress Shopping Cart & eCommerce Store plugin to the latest available version at least...
SQL Injection
Overview s-cart/core is a free Laravel e-commerce for business. Affected versions of this package are vulnerable to SQL Injection via the keyword parameter in /scadmin/currency. Remediation Upgrade s-cart/core to version 6.3.0.3 or higher. References - GitHub Additional Information - GitHub Commi...
CVE-2020-22403
Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...
CVE-2020-22403
Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...
Cross site request forgery (csrf)
Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...
CVE-2020-22403
Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...
CVE-2020-22403
CVE-2020-22403 affects the Express cart package for Node.js (v1.1.16). A CSRF vulnerability arises from missing/insufficient CSRF protections, enabling an attacker to perform unintended actions such as creating an administrator account or adding a discount code. The issue is confirmed across mult...
express-cart 跨站请求伪造漏洞
express-cart is a shopping cart module used in Node.js. A cross-site request forgery vulnerability exists in express-cart in Node.js, which stems from a WEB application that does not adequately validate that a request is coming from a trusted user. An attacker could use this vulnerability to send...
PT-2021-10761 · Npm · Express-Cart
Name of the Vulnerable Software and Affected Versions: Express cart versions 1.1.10 and earlier Express cart version 1.1.16 Description: A Cross Site Request Forgery CSRF issue allows attackers to add an administrator account, add a discount code, or have other unspecified impacts. This issue...
Sourcecodester Basic Shopping Cart SQL Injection Vulnerability
SourceCodester Basic Shopping Cart is a Web application from SourceCodester USA. The program allows visitors to your online shopping site to collect items in a virtual shopping cart through multiple product pages without losing ordered items. A SQL injection vulnerability exists in SourceCodester...
CVE-2021-34165
A SQL Injection vulnerability in Sourcecodester Basic Shopping Cart 1.0 allows a remote attacker to Bypass Authentication and become Admin...