4890 matches found
CVE-2017-10886
CS-Cart Japanese Edition (and Multivendor Japanese Edition) is affected by CVE-2017-10886. A cross-site scripting vulnerability exists in CS-Cart Japanese Edition versions 4.3.10 and earlier (excluding v2/v3), enabling an attacker to inject arbitrary web script or HTML via unspecified vectors. Th...
CVE-2017-10886
Cross-site scripting vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier excluding v2 and v3, CS-Cart Multivendor Japanese Edition v4.3.10 and earlier excluding v2 and v3 allows an attacker to inject arbitrary web script or HTML via unspecified vectors...
CS-Cart Japanese Edition vulnerable to cross-site scripting
Overview CS-Cart is a system for creating online shopping websites. CS-Cart Japanese Edition contains a cross-site scripting vulnerabulity CWE-79. Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...
JVN#29602086: CS-Cart Japanese Edition vulnerable to cross-site scripting
CS-Cart is a system for creating online shopping websites. CS-Cart Japanese Edition contains a cross-site scripting vulnerabulity CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest version according to the information...
Cross-site Scripting (XSS)
woocommerce is vulnerable to cross-site scripting XSS attacks. A malicious user can inject arbitrary web script through the various parameters of the product object that is executed when the products are added to the web cart...
CVE-2017-15975
Vastal I-Tech Dating Zone 0.9.9 allows SQL Injection via the 'productid' to addtocart.php, a different vulnerability than CVE-2008-4461...
Razer US: Customer's e-mail disclosure
It was found that sharing saved cart to Facebook leaks the user e-mail, thus the audience can retrieve it from the link. We appreciate the contribution by @gdinar in helping keep Razer's online properties secure...
Remote code execution
X-Cart 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 is vulnerable to Remote Code Execution. This vulnerability exists because the application fails to check remote file extensions before saving locally. This vulnerability can be exploited by anyone with Vendor access or higher. One attack methodology is ...
CVE-2017-15285
X-Cart 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 is vulnerable to Remote Code Execution. This vulnerability exists because the application fails to check remote file extensions before saving locally. This vulnerability can be exploited by anyone with Vendor access or higher. One attack methodology is ...
CVE-2017-15285
X-Cart 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 is vulnerable to Remote Code Execution. This vulnerability exists because the application fails to check remote file extensions before saving locally. This vulnerability can be exploited by anyone with Vendor access or higher. One attack methodology is ...
CVE-2017-15285
X-Cart 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 are vulnerable to Remote Code Execution due to improper validation of uploaded file extensions before saving locally. The issue can be exploited by anyone with Vendor access or higher by uploading an image file in a product catalog attachment, then uplo...
CVE-2017-15285
X-Cart 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 is vulnerable to Remote Code Execution. This vulnerability exists because the application fails to check remote file extensions before saving locally. This vulnerability can be exploited by anyone with Vendor access or higher. One attack methodology is ...
X-Cart Remote Code Execution Vulnerability
X-Cart is e-commerce PHP shopping cart software. X-Cart suffers from a remote code execution vulnerability due to the application failing to check remote file extensions before saving locally. An attacker could exploit the vulnerability to gain vendor access or higher privileges...
slgslg.com XSS vulnerability
Vulnerable URL: http://slgslg.com/tw/shoppingcart2/cartimg.php?imgname=%22/%3E%3Cscript%3Ealert/OPENBUGBOUNTY/;%3C/script%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 08.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown ...
MarketPress <= 3.2.6 - PHP Object Injection
The MarketPress plugin installs to a directory named wordpress-ecommerce versions 3.2.6 and prior are vulnerable to a PHP Object Injection attack from the cart cookie value stored in connection with this plugin. Send an object to the site using the mpglobalcart cookie value and it will be...
Directory traversal
Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the act parameter to ajax.php...
CVE-2015-8352
Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the act parameter to ajax.php...
CVE-2015-8352
CVE-2015-8352 affects Zen Cart 1.5.4 and is a Local File Inclusion vulnerability triggered by directory traversal in the Ajax endpoint. The flaw occurs in the /ajax.php act parameter processing, allowing remote, unauthenticated attackers to include and execute arbitrary local PHP files, potential...