CVE-2026-87091

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.12.2 . The root cause is insufficient input sanitization and output escaping regarding the 'rel' and 'option' parameters within the IPN endpoint. Because these para...

Sitecore Experience Platform <= 10.4 - Arbitrary File Read

An issue was discovered in Sitecore Experience Platform XP, Experience Manager XM, and Experience Commerce XC 8.0 Initial Release through 10.4 Initial Release. An unauthenticated attacker can read arbitrary files. id: CVE-2024-46938 info: name: Sitecore Experience Platform = 10.4 - Arbitrary File...

Cloudpanel 2 < 2.3.1 - Remote Code Execution

CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. id: CVE-2023-35885 info: name: Cloudpanel 2 2.3.1 - Remote Code Execution author: DhiyaneshDk severity: critical description: | CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. impact: | Successfu...

CVE-2026-11795

Observable discrepancy vulnerability in Softtr Informatics Trading Limited Company E-Commerce Pack allows Account Footprinting. This issue affects E-Commerce Pack: through 2026-10-02. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2026-11795

The Softtr Informatics Trading Limited Company E-Commerce Pack (affected through 2026-10-02) contains an observable discrepancy vulnerability (CWE-203) that facilitates Account Footprinting . This flaw allows for user enumeration or footprinting within the application. No specific root cause deta...

EUVD-2026-91591

Observable discrepancy vulnerability in Softtr Informatics Trading Limited Company E-Commerce Pack allows Account Footprinting. This issue affects E-Commerce Pack: through 2026-10-02. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2024-34102

CVE-2024-34102 - CosmicSting XXE エクスプロイト CVE-2024-34102 CosmicSting のエクスプロイト - Adobe Commerce および Magento の XML 外部実体 XXE 脆弱性。 📋 脆弱性について CVE-2024-34102 は、以下に影響を与える重大な XXE XML 外部実体 脆弱性です: Adobe Commerce バージョン 2.4.7、2.4.6-p5、2.4.5-p7、2.4.4-p8 およびそれ以前 Magento Open Source 同じバージョン...

stylesmuggler-ioc-toolkit

StyleSmuggler IOC Toolkit — CVE-2026-75650 Magento zero-day · Adobe Commerce zero-day · CVE-2026-75650 · APSB26-146 · VULN-39341 · unauthenticated RCE · Magento malware · Magento backdoor removal · Magento 2.4.9 vulnerability · Rust implant · GraphQL styles injection · PHP web shell Community...

CVE-2025-61456

🛡️ CVE開示: CVE-2025-61456 — Eコマースプロジェクトにおける反射型XSS 開示日: 2025年10月14日 CVE ID: CVE-2025-61456 深刻度: MEDIUM CVSS 6.1 🧩 概要 E-commerce Project v1.0 の index.php...

CVE-2025-61455

🛡️ CVE 開示: CVE-2025-61455 — EコマースプロジェクトにおけるSQLインジェクション 開示日: 2025年10月14日 CVE ID: CVE-2025-61455 深刻度: CRITICAL CVSS 9.8 🧩 概要 E-commerce Project v1.0 の signup.inc.php エンドポイントに、重大なSQLインジェクションの脆弱性が存在します。このアプリケーションは、サニタイズされていないユーザー入力をSQLクエリに直接組み込んでおり、認証されていない攻撃者が認証をバイパスし、任意のSQLコマンドを実行できる可能性があります。...

CVE-2025-61454

🛡️ CVE 開示: CVE-2025-61454 — Eコマースプロジェクトにおける反射型XSS 開示日: 2025年10月14日 CVE ID: CVE-2025-61454 深刻度: MEDIUM CVSS 6.1 🧩 概要 E-commerce Project v1.0 の search.php エンドポイントに、反射型クロスサイトスクリプティング XSS の脆弱性が存在します。search...

CVE-2022-24086-CVE-2022-24087

CVE-2022-24086-CVE-2022-24087 Picus Cyber Talent Academy 과제를 위해 Magento 및 Adobe Commerce RCE 취약점 CVE-2022-24086&CVE-2022-24087에 대해 제가 작성한 블로그 게시물은 CVE-2022-24086&CVE-2022-24087.pdf에서 확인할 수 있습니다...

SessionReaper-CVE-2025-54236

SessionReaper — CVE-2025-54236 CVE-2025-54236 "SessionReaper"를 위한 통합 PoC, Magento 2 / Adobe Commerce의 REST API에서 중첩 역직렬화를 통한 중요한 인증되지 않은 RCE입니다. CVSS: 9.1 심각 근본 원인: 부적절한 입력 검증 CWE-20; 익스플로잇 기본 요소는 안전하지 않은 역직렬화 CWE-502 최초 연구자: Daniel "Blaklis" Le Gall HackerOne을 통한 책임 공개 명명자: Sansec 수정 버전: Adobe...

magento-cve-2024-34102-exploit-cosmicstring

CVE 2024-34102 - Adobe Commerce 및 Magento의 CosmicSting XXE 취약점 - 교육 자료 이 저장소에는 Adobe Commerce 및 Magento 의 최신 XML External EntityXXE 취약점 에 대한 제 강연의 슬라이드와 데모 자료가 포함되어 있습니다. 이 자료의 목적은 순전히 교육적인 것으로, 개발자, 보안 전문가 및 전자상거래 이해관계자에게 이 취약점, 잠재적 영향 및 이에 대비하는 방법을 알리기 위해 설계되었습니다. 목차 슬라이드 : 취약점의 개요와 작동 방식 XXE 데...

CVE-2026-92994

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript...

CVE-2026-92994 Verge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage API

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript...

CVE-2026-92994

The Verge3D Publishing and E-Commerce WordPress plugin before version 4.13.1 is vulnerable to unauthenticated Stored XSS . The flaw exists because the plugin's file storage feature fails to validate the contents of uploaded files and serves them back with an attacker-controlled content type. This...

EUVD-2026-89622

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript...

CVE-2026-92994 Verge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage API

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript...

CVE-2013-3651

CVE-2013-3651 PoC - EC-CUBE 2 사용하기 필요 사항 Python 3 실행 $ python poccve20133651.py - 예시 $ python poccve20133651.py http://127.0.0.1:9000/ 결과: 취약함! PoC 취약점 | ECサイト構築・リニューアル은「EC 오픈 플랫폼 EC-CUBE」 https://www.ec-cube.net/info/weakness/weakness.php?id=49 참고 JVNDB-2013-000062 - JVN iPedia...