CVE-2024-34102

CVE-2024-34102 ★ Thanks to @th3gokul, Sanjaith3hacker, Chocapikk for the original code base. ★ Description CVE-2024-34102 : Adobe Commerce XXE vulnerability description: Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External...

CVE-2022-24086-RCE-PoC

CVE-2022-24086 RCE POC About CVE-2022-24086 which Adobe saw being “exploited in the wild in very limited attacks” received a severity score of 9.8 out of 10, and adversaries exploiting it can achieve remote code execution on affected systems without the need to authenticate. Issue that is now...

The vulnerability of the ReadyScript e-commerce management system, related to improper session management, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the ReadyScript e-commerce management system is related to improper session management. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the ReadyScript e-commerce management system, related to the unlimited loading of dangerous type files, allows a hacker to upload any type of files.

The vulnerability of the ReadyScript e-commerce management system is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to load any desired files...

The vulnerability of the ReadyScript e-commerce management system lies in the improper implementation of the sequence of actions to be performed, which allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ReadyScript e-commerce management system is related to the improper implementation of the sequence of actions to be performed. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected informati...

The vulnerability of the ReadyScript e-commerce management system, related to the unlimited loading of dangerous type files, allows a hacker to upload any type of files.

The vulnerability of the ReadyScript e-commerce management system is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to load any desired files...

CVE-2025-7461

CVE-2025-7461: SQL Injection Vulnerability Analysis in Modern Bag E-commerce System 🌐 Language / 语言 : English | 简体中文 Vulnerability Overview Vulnerability Database: https://vuldb.com/?id.316112 Project Source: https://code-projects.org/modern-bag-in-php-css-javascript-and-mysql-free-download/ Item...

oss-oopssec-store

OSS - OopsSec Store Security training for the apps you actually ship. 36 challenges across web, API, authentication, business logic, cryptography, supply chain, AI agents and MCP. Break a deliberately vulnerable e-commerce app built on Next.js, React, TypeScript and Prisma. Find the bugs. Exploit...

CVE-2024-34102

CVE-2024-34102 POC for CVE-2024-34102. A pre-authentication XML entity injection issue in Magento / Adobe Commerce. Overview This POC will attempt to read files from target hosts that are vulnerable to the recent Magento / Adobe Commerce CVE-2024-34102. This POC is based on this security advisory...

CVE-2024-34102-CosmicSting-XXE-in-Adobe-Commerce-and-Magento

CosmicSting: critical unauthenticated XXE vulnerability in Adobe Commerce and Magento CVE-2024-34102 CVE-2024-34102 is a severe security flaw arising from improper handling of nested deserialization in Adobe Commerce and Magento. This vulnerability permits attackers to exploit XML External Entiti...

CVE-2024-34102

Cosmic Sting: CVE-2024-34102 Exploiter Cosmic Sting is a Go-based tool designed to exploit CVE-2024-34102, Remote Code Execution vulnerability. CVE-2024-34102 Detail Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External...

cve-2026-71362-magento-lab

CVE-2026-71362 — лаборатория переключения идентичности клиентской сессии Magento / Adobe Commerce Автономная Docker-лаборатория, запускаемая одной командой, которая воспроизводит CVE-2026-71362 от начала до конца и позволяет проверить исправление Adobe, чтобы защитники, исследователи и студенты...

WordPress Welcart e-Commerce plugin <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by minhgalaxy in WordPress Plugin Welcart e-Commerce versions = 2.12.2...

CVE-2022-24086-RCE

CVE-2022-24086-RCE CVE-2022-24086 RCE Description Adobe Commerce versions 2.4.3-p1 and earlier and 2.3.7-p2 and earlier are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrar...

CVE-2026-87091

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-87091 Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-91910

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-87091

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.12.2 . The root cause is insufficient input sanitization and output escaping regarding the 'rel' and 'option' parameters within the IPN endpoint. Because these para...

Sitecore Experience Platform <= 10.4 - Arbitrary File Read

An issue was discovered in Sitecore Experience Platform XP, Experience Manager XM, and Experience Commerce XC 8.0 Initial Release through 10.4 Initial Release. An unauthenticated attacker can read arbitrary files. id: CVE-2024-46938 info: name: Sitecore Experience Platform = 10.4 - Arbitrary File...

Cloudpanel 2 < 2.3.1 - Remote Code Execution

CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. id: CVE-2023-35885 info: name: Cloudpanel 2 2.3.1 - Remote Code Execution author: DhiyaneshDk severity: critical description: | CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. impact: | Successfu...