Zen Cart 1.5.4 Code Execution / Information Disclosure

Zen Cart 1.5.4: Code Execution and Information Leak Security Advisory – Curesec Research Team 1. Introduction Affected Product: Zen Cart 1.5.4 Fixed in: partial fix via patch Partial Patch Link: https://www.zen-cart.com/showthread.php?218239-curesec-security-report-Patch-Included Vendor Contact:...

WordPress Shopping Cart 3.0.4 --任意文件上传

受影响版本: WordPress Shopping Cart 3.0.4 日期: 29-10-2014 软件链接: https://wordpress.org/plugins/wp-easycart/ CVE: CVE-2014-9308 类别: 应用程序漏洞详情：任何注册用户都可以上传任何文件。上传点: wp-easycart\inc\amfphp\administration\banneruploaderscript.php$date = $POST'datemd5';$usersqlquery = sprintf"SELECT ecuser., ecrole.adminaccess...

WordPress Abandoned Cart Lite Plugin <= 1.8 - SQL Injection

Because of this vulnerability, the attackers can execute arbitrary SQL commands via "orderby" and :order" parameters. Solution Update the plugin...

Creative X-Cart Cross-Site Scripting Vulnerability

Creative X-Cart is a Russian company Creative open source PHP e-commerce software . The software provides favorites , order records and inventory management modules. A cross-site scripting vulnerability exists in Creative X-Cart 4.5.0 and earlier versions. A remote attacker can exploit this...

KesionIMalv2.5逻辑漏洞（DEMO演示）

简要描述： RT 详细说明： demo地址：http://imall.kesion.com 修改购物车内商品数量时，抓包修改为-1，提交订单后，点击支付，该订单直接支付成功。 ht...

CVE-2015-5455

Cross-site scripting XSS vulnerability in X-Cart 4.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to install/...

Cross site scripting

Cross-site scripting XSS vulnerability in X-Cart 4.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to install/...

CVE-2015-5455

CVE-2015-5455 targets X-Cart, specifically version 4.5.0 and earlier. The vulnerability is described as a cross-site scripting (XSS) issue that could allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the install/ directory. The connected documents confirm th...

CVE-2015-5455

Cross-site scripting XSS vulnerability in X-Cart 4.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to install/...

X-Cart 4.5.0 Cross Site Scripting

Exploit Title: X-Cart Cross Site Scripting Date: 30/06/2015 Exploit Author: nopesled Vendor Homepage: http://www.x-cart.com/ Version: 4.5.0 and possibly earlier Details ------- Websites running X-Cart version 4.5.0 and possibly below which have not removed their /install/ directory are vulnerable...

Lively cart SQL Injection Vulnerability

Exploit for multiple platform in category web applications Exploit Title : Lively cart SQL Injection vulnerability Author : Manish Kishan Tanwar AKA error1046 Vendor Link : http://codecanyon.net/item/livelycart-a-jquery-php-store-shop/5531393 Date : 18/06/2015 Love to : zero cool,Team...

Lively Cart - SQL Injection

Lively Cart - SQL Injection Exploit Title : Lively cart SQL Injection vulnerability Author : Manish Kishan Tanwar AKA error1046 Vendor Link : http://codecanyon.net/item/livelycart-a-jquery-php-store-shop/5531393 Date : 18/06/2015 Love to : zero cool,Team indishell,Mannu,Viki,Hardeep...

Lively Cart - SQL Injection

Exploit Title : Lively cart SQL Injection vulnerability Author : Manish Kishan Tanwar AKA error1046 Vendor Link : http://codecanyon.net/item/livelycart-a-jquery-php-store-shop/5531393 Date : 18/06/2015 Love to : zero cool,Team indishell,Mannu,Viki,Hardeep Singh,Incredible,Kishan Singh and ritu...

WordPress Shopping Cart Plugin <= 8.1.14 - Multiple Vulnerabilities

This plugin is prone to a shell upload and SQL injection vulnerabilities. Solution Update plugin...

CVE-2015-3301

Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. dot dot in the tcpboxpath parameter in the checkouteditorsettings page to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allow remote attackers to inject arbitrary web script or HTML via the 1 billingfirstname, 2 billinglastname, 3...

Directory traversal

Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. dot dot in the tcpboxpath parameter in the checkouteditorsettings page to...

CVE-2015-3986

Cross-site request forgery CSRF vulnerability in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allows remote attackers to hijack the authentication of administrators for requests that conduct directory traversal attack...

CVE-2015-3300

Multiple cross-site scripting XSS vulnerabilities in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allow remote attackers to inject arbitrary web script or HTML via the 1 billingfirstname, 2 billinglastname, 3...

CVE-2015-3986

TheCartPress eCommerce Shopping Cart (WordPress plugin) is affected by CVE-2015-3986: CSRF allows remote attackers to hijack administrator sessions via directory traversal through tcp_box_path on the checkout_editor_settings page leading to wp-admin/admin.php. Affected versions: WordPress plugin ...