WooCommerce Green Wallet Gateway < 1.0.2 - Reflected Cross Site Scripting in checkout page

The plugin does not escape the errorenvision query parameter before outputting it to the page, leading to a Reflected Cross-Site Scripting vulnerability. PoC 1. Enable greenwallet-gateway as a woocommerce payment gateway 2. add something in your cart and visit the checkout page 3. visit...

GHSA-PRFF-6J8Q-VRV7 Cross-site Scripting in microweber

There is a persistent XSS Vulnerability exsists in the checkout page where we can able to execute any javascription in the last name field...

Cross-site Scripting (XSS) - Stored in microweber/microweber

Description There is a persistent XSS Vulnerability exsists in the checkout page where we can able to execute any javascription in the last name field...

PT-2021-22549 · WordPress · Credova Financial

Name of the Vulnerable Software and Affected Versions: Credova Financial WordPress plugin versions up to, and including, 1.4.8 Description: The Credova Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX action whenever a sit...

Boom! Mobile Customer Data Lost to Fullz House/Magecart Attack

Boom! Mobile’s U.S. website recently fell victim to an e-commerce attack, putting online shoppers in danger of payment-card theft, researchers said. Boom! is a wireless provider that resells mobile phone plans from Verizon, AT&T and T-Mobile USA, under its own brand and with its own perks the...

Magento cross-site scripting vulnerability (CNVD-2019-26229)

Magento is an open source e-commerce platform written in PHP. A reflective cross-site scripting vulnerability exists in Magento's customer shopping cart checkout page. An attacker can exploit this vulnerability to execute malicious javascript in the victim's browser by sending a specially crafted...

store1.esellerate.net XSS vulnerability

Open Bug Bounty ID: OBB-622934 Description| Value ---|--- Affected Website:| store1.esellerate.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

cinemex.com XSS vulnerability

Open Bug Bounty ID: OBB-556849 Description| Value ---|--- Affected Website:| cinemex.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

OnePlus denies checkout page hack amid credit card fraud reports

By Waqas OnePlus, a Shenzhen based Chinese smartphone manufacturer has denied that This is a post from HackRead.com Read the original post: OnePlus denies checkout page hack amid credit card fraud reports...

lagerhotel.skat.dk XSS vulnerability

Vulnerable URL: http://lagerhotel.skat.dk/checkout/shopbasketcheckout.aspx Details: Description| Value ---|--- Patched:| No Latest check for patch:| 23.10.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Coordinat...

rawnitro.com XSS vulnerability

Vulnerable URL: http://www.rawnitro.com/checkout.php?name=elite-green-coffee"';-- Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 6387177 VIP website status:| No Coordinated...

safeshop.co.nz XSS vulnerability

Vulnerable URL: https://www.safeshop.co.nz/ccdsydney/bookstore/checkout.php?CartId=b0ed80655419d4649c0a0c255d5e46da...

my.tomtop.com XSS vulnerability

Vulnerable URL: https://my.tomtop.com/checkout/order/tracking Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Coordinated Disclosure...

simplycombo.com XSS vulnerability

Vulnerable URL: https://www.simplycombo.com/checkout/?paymentsuccpage=%22%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3Elandingpage=/my-contentname=Simply%20Combosubmitted=Y=https%3A//www.simplycombo.com/checkout/=buynowlastupsell=YESgateway=stripe=Y=Y=N Details: Description| Value ---|--- Patched:| No...

mihanstore.co XSS vulnerability

Vulnerable URL: http://www.mihanstore.co/cart.php?step=checkout Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 266609 VIP website status:| No Check mihanstore.co SSL connection:| Grade: F Coordinated Disclosure...

actionmoments.com XSS vulnerability

Vulnerable URL: https://www.actionmoments.com/checkout.php?cf=FC="="&welcome.x;=0&welcome.y;=0 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 5412923 VIP website status:| No Check...

Wirecard Checkout Page 1.0 Price Manipulation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Advisory ID: SYSS-2015-061 Product: Wirecard Checkout Page Manufacturer: Wirecard AG Affected Versions: 1.0 Tested Versions: 1.0 Vulnerability Type: Improper Validation of Integrity Check Value CWE-354 Risk Level: High Solution Status: Fixed...

loboo.se XSS vulnerability

Vulnerable URL: http://www.loboo.se/checkout.asp?CartID=="=C7805CS=0'A=0 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google Pagerank| 2 VIP website...

Unfixed XSS vulnerability at www.emagic.co.uk

Security researcher nullbyt3, has submitted on 10/07/2010 a cross-site-scripting XSS vulnerability affecting www.emagic.co.uk, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 20/12/2011. It is currently...

jCart 1.1 Cross Site Request Forgery / Cross Site Scripting

additem$itemid, $itemqty, $itemprice, $itemname; ------------------------- User-supplied input for variable $itemname isn't properly escaped. Proof-of-Concept: -- alertdocument.cookie" type="hidden" document.getElementById'payload'.click...