CVE-2019-7220

CVE-2019-7220 affects X-Cart V5, where a cross-site scripting (XSS) vulnerability is exposed through the CategoryFilter2 parameter. The connected documents consistently describe X-Cart V5 as vulnerable to XSS via this parameter, indicating a flaw in input handling/validation that allows injection...

Duplicate Advisory: Privilege Escalation in express-cart

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hr89-w7p6-pjmq. This link is maintained to preserve external references. Original Description Versions of express-cart before 1.1.6 are vulnerable to privilege escalation. This vulnerability can be exploited so...

RSEvents! Pro Cart Plugin older than 1.1.15 ,Other

RSEvents! Pro Cart Plugin older than 1.1.15,Other UpdateNotice URL https://www.rsjoomla.com/blog/view/468-csv-vulnerability-explained.html...

CVE-2019-2652

Vulnerability in the Oracle iStore component of Oracle E-Business Suite subcomponent: Shopping Cart. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network...

TomTom: CSRF allows attacker to manage customer's shopping cart.

The following endpoint https://www.tomtom.com:443/enus/store/basket-add.html had no CSRF checks / tokens .. whatsoever , which allows a malicious user add massive amounts of a any product to a victim's cart or empty the cart. the CSRF POC file included adds 50 items of the giving product the a...

Ashop Shopping Cart Software - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Ashop Shopping Cart Software - SQL Injection Exploit Author: Doğukan Karaciğer Vendor Homepage: http://www.ashopsoftware.com Software Link: https://sourceforge.net/projects/ashop/ Demo Site: http://demo.ashopsoftware.com/ Versio...

Ashop Shopping Cart Software - 'bannedcustomers.php?blacklistitemid' SQL Injection

Exploit Title: Ashop Shopping Cart Software - SQL Injection Date: 08.04.2019 Exploit Author: Doğukan Karaciğer Vendor Homepage: http://www.ashopsoftware.com Software Link: https://sourceforge.net/projects/ashop/ Demo Site: http://demo.ashopsoftware.com/ Version: Lastest Tested on: Ubuntu-trusty-6...

Ashop Shopping Cart Software - bannedcustomers.php?blacklistitemid SQL Injection

Ashop Shopping Cart Software - bannedcustomers.php?blacklistitemid SQL Injection Exploit Title: Ashop Shopping Cart Software - SQL Injection Date: 08.04.2019 Exploit Author: Doğukan Karaciğer Vendor Homepage: http://www.ashopsoftware.com Software Link: https://sourceforge.net/projects/ashop/ Demo...

Ashop Shopping Cart Software SQL Injection

Exploit Title: Ashop Shopping Cart Software - SQL Injection Date: 08.04.2019 Exploit Author: Doğukan Karaciğer Vendor Homepage: http://www.ashopsoftware.com Software Link: https://sourceforge.net/projects/ashop/ Demo Site: http://demo.ashopsoftware.com/ Version: Lastest Tested on: Ubuntu-trusty-6...

Ashop Shopping Cart Software - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Ashop Shopping Cart Software - SQL Injection Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: http://www.ashopsoftware.com Software Link: https://sourceforge.net/projects/ashop/ Demo Site: http://demo.ashopsoftware.com/ Versio...

Ashop Shopping Cart Software - SQL Injection

Ashop Shopping Cart Software - SQL Injection Exploit Title: Ashop Shopping Cart Software - SQL Injection Date: 03.03.2019 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: http://www.ashopsoftware.com Software Link: https://sourceforge.net/projects/ashop/ Demo Site: http://demo.ashopsoftware.com...

Ashop Shopping Cart Software SQL Injection

Exploit Title: Ashop Shopping Cart Software - SQL Injection Date: 03.03.2019 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: http://www.ashopsoftware.com Software Link: https://sourceforge.net/projects/ashop/ Demo Site: http://demo.ashopsoftware.com/ Version: Lastest Tested on: Kali Linux CVE:...

PT-2019-18614 · Woocommerce · Woocommerce Paypal Checkout Payment Gateway

Name of the Vulnerable Software and Affected Versions: WooCommerce PayPal Checkout Payment Gateway plugin version 1.6.8 Description: The issue allows Parameter Tampering in an amount parameter, such as amount 1, in the /cgi-bin/webscr?cmd= cart endpoint. This can be exploited by purchasing an ite...

WordPress Abandoned Cart Lite plugin <= 5.1.3 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability found in WordPress Abandoned Cart Lite plugin versions = 5.1.3. Solution Update the WordPress Abandoned Cart Lite plugin to the latest available version at least 5.2.0...

WordPress Abandoned Cart Pro plugin <= 7.12.0 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability found in WordPress Abandoned Cart Pro plugin versions = 7.12.0. Solution Update the WordPress Abandoned Cart Pro plugin to the latest available version at least 7.13.0...

Abandoned Cart Lite for WooCommerce < 5.2.0 - Unauthenticated Stored Cross-Site Scripting (XSS)

The savedata AJAX call, used by unauthenticated users, such as guest during the checkout process, does not sanitise or validate user input for example billingfirstname, billinglastname, and billingcompany fields. This leads to a Stored Cross-Site Scripting issue which will be triggered in the adm...

VulnCheck KEV: CVE-2019-25152

The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping...

CVE-2019-9626

PHPSHE 1.7 allows module/index/cart.php pintuanid SQL Injection to index.php...

GHSA-WJ36-V8J4-PC7C Authentication Bypass by Spoofing in express-cart

A deficiency in the access control in module express-cart =1.1.5 allows unprivileged users to add new users to the application as administrators...

The vulnerability of the Support Cart component of the Oracle Applications Manager, a system for automating business operations within the Oracle E-Business Suite. This vulnerability allows an attacker to gain unauthorized access to protected data.

The vulnerability of the Support Cart component in the Oracle Applications Manager application management tool, part of the Oracle E-Business Suite, is related to access control errors. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to...