amazingdayyoga.com XSS vulnerability

Vulnerable URL: https://amazingdayyoga.com/checkout-stripe/?paymentsuccpage=%22%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3Elandingpage=/thankyouname=Yoga%20Journeysubmitted=Y=/checkout-stripe=buynowlastupsell=YESgateway=stripe=Y=N=N Details: Description| Value ---|--- Patched:| No Latest check for...

shop.platformpurple.com XSS vulnerability

Open Bug Bounty ID: OBB-199289 Description| Value ---|--- Affected Website:| shop.platformpurple.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

logosack.com XSS vulnerability

Vulnerable URL: http://logosack.com/checkout/ Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 11688143 VIP website status:| No Check logosack.com SSL connection:| Grade: C+ Coordinated Disclosure Timeline:...

mihanstore.co XSS vulnerability

Vulnerable URL: http://www.mihanstore.co/cart.php?step=checkout Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 266609 VIP website status:| No Check mihanstore.co SSL connection:| Grade: F Coordinated Disclosure...

Woo Custom Checkout Field <= 1.3.4 - CSRF & Stored XSS

Due to a lack of CSRF mitigation and entity encoding in the ccfinsert function found on line 118 of include/ccf.php and in the output generated by template/datagrid.php, it is possible to store and execute scripts in the context of an admin user. PoC...

Woo Custom Checkout Field <= 1.3.4 - CSRF & Stored XSS

Due to a lack of CSRF mitigation and entity encoding in the ccfinsert function found on line 118 of include/ccf.php and in the output generated by template/datagrid.php, it is possible to store and execute scripts in the context of an admin user...

actionmoments.com XSS vulnerability

Vulnerable URL: https://www.actionmoments.com/checkout.php?cf=FC="="&welcome.x;=0&welcome.y;=0 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 5412923 VIP website status:| No Check...

get.ink XSS vulnerability

Vulnerable URL: https://get.ink/checkout/search/bl.ink" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 6141307 VIP website status:| No Check get.ink SSL connection:| Grade: A...

Shopify: Stored XSS in https://checkout.shopify.com/

STEPS TO REPRODUCE 1. Go to http://hardware.shopify.com/products/custom-gift-card?variant=976094353 and Design your own gift card. 2. Change file type to url on the upload field. 3. Add the payload...

LeaseWeb: DOM Based XSS in Checkout

Hey, This works in all browsers I suppose and regardless if the user is currently authenticated or not. Simply go over to : https://www.leaseweb.com/checkout-success/16893". Attached herewith is the screenshot. Thanks!...

Wirecard Checkout Page 1.0 Price Manipulation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Advisory ID: SYSS-2015-061 Product: Wirecard Checkout Page Manufacturer: Wirecard AG Affected Versions: 1.0 Tested Versions: 1.0 Vulnerability Type: Improper Validation of Integrity Check Value CWE-354 Risk Level: High Solution Status: Fixed...

Shopify: [CSRF] Activate PayPal Express Checkout

Hi , i have found a CSRF issue when activating PayPal Express checkout. Steps to reproduce: 1. Create a new store then login with the admin account. 2. Go to https://.myshopify.com/admin/settings/payments and you'll see that PayPal Express checkout is already active , so click the edit button and...

UC Profile - Moderately Critical - Information Disclosure - SA-CONTRIB-2015-165

UC Profile module enables you to collect profile fields for users during the checkout process of Ubercart as a checkout pane. The module doesn't sufficiently check access to profiles under certain circumstances. Depending on the information being collected, sensitive data may be exposed. This...

Shopify: 'Limited' RCE in certain places where Liquid is accepted

Short ==== Certain interfaces where a shop owner/administrator is able to utilize Liquid have access to methods and properties of certain Drops. This allows calling all methods of the object and access to all properties. While this sounds bad, it seems to be very limited and seems to be 'only'...

moz.com XSS vulnerability

Vulnerable URL: https://moz.com/checkout/signup/51?mozerror Details: Description| Value ---|--- Patched:| Yes, at 23.11.2017 Latest check for patch:| 23.11.2017 09:02 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1036 Google Pagerank| 6 VIP website status:| Ye...

loboo.se XSS vulnerability

Vulnerable URL: http://www.loboo.se/checkout.asp?CartID=="=C7805CS=0'A=0 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google Pagerank| 2 VIP website...

CVE-2015-4384

Cross-site scripting XSS vulnerability in the Ubercart Webform Checkout Pane module 6.x-3.x before 6.x-3.10 and 7.x-3.x before 7.x-3.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Ubercart Webform Checkout Pane module 6.x-3.x before 6.x-3.10 and 7.x-3.x before 7.x-3.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4368

The Commerce Ogone module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to complete the checkout for an order without paying via unspecified vectors...

CVE-2015-4384

Cross-site scripting XSS vulnerability in the Ubercart Webform Checkout Pane module 6.x-3.x before 6.x-3.10 and 7.x-3.x before 7.x-3.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...