CVE-2015-3301

Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. dot dot in the tcpboxpath parameter in the checkouteditorsettings page to...

CVE-2015-3301

The CartPress/TheCartPress WordPress plugin (vulnerable before 1.3.9.3) suffers a Local PHP File Inclusion/Directory Traversal (CVE-2015-3301) via the tcp_box_path parameter in checkout_editor_settings (/wp-admin/admin.php?page=checkout_editor_settings). Exploitation requires administrative privi...

CVE-2015-3300

Multiple cross-site scripting XSS vulnerabilities in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allow remote attackers to inject arbitrary web script or HTML via the 1 billingfirstname, 2 billinglastname, 3...

TheCartPress <= 1.3.9 - Multiple Vulnerabilities

The TheCartPress eCommerce Shopping Cart WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability...

X_CART Multiple Cross Site Scripting Vulnerabilities

XCART is prone to multiple cross site scripting vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:qualiteam:x-cart...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that 1 delete a product via a deleteproductconfirm action to product.php or 2 disable a product via a setflag action to categories.php...

CVE-2011-4403

Multiple cross-site request forgery CSRF vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that 1 delete a product via a deleteproductconfirm action to product.php or 2 disable a product via a setflag action to categories.php...

CVE-2011-4403

CVE-2011-4403 affects Zen Cart 1.3.9h. A CSRF vulnerability allows an attacker to make an authenticated administrator perform actions such as deleting a product (via product.php with action=delete_product_confirm) or disabling a product (via categories.php with setflag). The root cause is cross‑s...

CVE-2011-4403

Multiple cross-site request forgery CSRF vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that 1 delete a product via a deleteproductconfirm action to product.php or 2 disable a product via a setflag action to categories.php...

X-Cart Cross-Site Scripting Vulnerability (CNVD-2015-02183)

X-Cart is an open source PHP e-commerce software . The software provides favorites , order records and inventory management modules. A cross-site scripting vulnerability exists in the admin.php script in X-Cart versions 5.1.6 through 5.1.10. A remote attacker can exploit this vulnerability to...

X-Cart Privilege Access Vulnerability

X-Cart is an open source PHP e-commerce software . The software provides favorites , order records and inventory management modules. A security vulnerability exists in X-Cart 5.1.10 and earlier versions. A remote attacker can exploit this vulnerability by sending a modified update or delete reque...

CVE-2015-0951

X-Cart before 5.1.11 allows remote authenticated users to read or delete address data of arbitrary accounts via a modified 1 update or 2 remove request...

CVE-2015-0950

Cross-site scripting XSS vulnerability in admin.php in X-Cart 5.1.6 through 5.1.10 allows remote attackers to inject arbitrary web script or HTML via the substring parameter...

Cross site request forgery (csrf)

X-Cart before 5.1.11 allows remote authenticated users to read or delete address data of arbitrary accounts via a modified 1 update or 2 remove request...

Cross site scripting

Cross-site scripting XSS vulnerability in admin.php in X-Cart 5.1.6 through 5.1.10 allows remote attackers to inject arbitrary web script or HTML via the substring parameter...

CVE-2015-0951

X-Cart before 5.1.11 allows remote authenticated users to read or delete address data of arbitrary accounts via a modified 1 update or 2 remove request...

CVE-2015-0950

X-Cart 5.1.6–5.1.10 contains a reflected XSS in admin.php via the substring parameter, allowing remote script injection in the user’s browser. Root cause: improper handling of input leading to script execution. Impact: remote attacker could run arbitrary script in the context of victims’ sessions...

CVE-2015-0951

CVE-2015-0951 affects X-Cart before 5.1.11, enabling a remote, authenticated attacker to read or delete address data of other users via manipulated update/remove requests (insecure direct object reference). The issue affects 5.1.10 and earlier per CNVD/NVD/Cert notes; vendor fix is X-Cart 5.1.11....

CVE-2015-0950

Cross-site scripting XSS vulnerability in admin.php in X-Cart 5.1.6 through 5.1.10 allows remote attackers to inject arbitrary web script or HTML via the substring parameter...

X-Cart contains multiple vulnerabilities

Overview X-Cart versions 5.1.6 through 5.1.10 are vulnerable to cross-site scripting XSS, and versions 5.1.10 and below are vulnerable to authorization bypass. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' - CVE-2015-0950X-Cart versions 5.1...