CVE-2024-39322 aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records

aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks. In versions prior to 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2, improper access control allows editors to remove admin group and locale configuration in the Aimeos backend. Versions 2020.10.13,...

CVE-2024-39322

CVE-2024-39322 affects the aimes/ai-admin-jsonadm JSON API used for administrative tasks. In versions prior to 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2, improper access control allows editors to remove admin group and locale configuration in the Aimeos backend. A fix is present i...

Exploit for Improper Restriction of XML External Entity Reference in Adobe Commerce

CosmicSting: critical unauthenticated XXE vulnerability in Ado...

Vulnerabilities fixed in Adobe Commerce

Adobe has fixed vulnerabilities in Commerce and Magento. A malicious party could exploit the vulnerabilities to bypass security measures and execute arbitrary code, possibly with administrator privileges. Proof-of-Concept code PoC has been published for the vulnerability with reference...

Exploit for Improper Restriction of XML External Entity Reference in Adobe Commerce

🚨 CVE-2024-34102 Exploit Script 🚨 Description This script...

Exploit for Improper Restriction of XML External Entity Reference in Adobe Commerce

CVE-2024-34102 POC for CVE-2024-34102. A pre-authentication XM...

CVE-2024-36680: SQL Injection Vulnerability in Facebook’s PrestaShop Module Exposes Thousands of E-commerce Sites to Credit Card Fraud

SQL Injection Exposure in Promokit.eu Threatens Facebook's PrestaShop Customers PrestaShop is a free, open-source E-commerce platform launched in 2007. Built with PHP and MySQL, it offers customizable, scalable solutions for online stores. Features include product management, inventory tracking,...

New Credit Card Skimmer Targets WordPress, Magento, and OpenCart Sites

Multiple content management system CMS platforms like WordPress, Magento, and OpenCart have been targeted by a new credit card web skimmer called Caesar Cipher Skimmer. A web skimmer refers to malware that is injected into e-commerce sites with the goal of stealing financial and payment...

Over 110,000 Websites Affected by Hijacked Polyfill Supply Chain Attack

Google has taken steps to block ads for e-commerce sites that use the Polyfill.io service after a Chinese company acquired the domain and modified the JavaScript library "polyfill.js" to redirect users to malicious and scam sites. "Protecting our users is our top priority. We detected a security...

Adobe Commerce / Magento XML External Entity Injection (CosmicSting)

Adobe Magento Open Source / Commerce versions 2.4.7 2.4.7-p1, 2.4.6 2.4.6-p6, 2.4.5 2.4.5-p8, 2.4.4 2.4.4-p9 and earlier suffer from an XML External Entity XXE vulnerability. By exploiting this vulnerability and crafting a malicious XML document, a remote and unauthenticated attacker could achiev...

CVE-2024-38516

ai-client-html is an Aimeos e-commerce HTML client component. Debug information revealed sensitive information from environment variables in error log. This issue has been patched in versions 2024.04.7, 2023.10.15, 2022.10.13 and 2021.10.22...

CVE-2024-38516 Aimeos HTML client may potentially reveal sensitive information in error log

ai-client-html is an Aimeos e-commerce HTML client component. Debug information revealed sensitive information from environment variables in error log. This issue has been patched in versions 2024.04.7, 2023.10.15, 2022.10.13 and 2021.10.22...

CVE-2024-38516

CVE-2024-38516 affects the ai-client-html component of the Aimeos e-commerce stack. The root cause, as described across sources, is a vulnerability where debug information can leak sensitive data from environment variables via error logs. The issue is categorized as information disclosure with hi...

CVE-2024-38516 Aimeos HTML client may potentially reveal sensitive information in error log

ai-client-html is an Aimeos e-commerce HTML client component. Debug information revealed sensitive information from environment variables in error log. This issue has been patched in versions 2024.04.7, 2023.10.15, 2022.10.13 and 2021.10.22...

CVE-2024-38516 Aimeos HTML client may potentially reveal sensitive information in error log

ai-client-html is an Aimeos e-commerce HTML client component. Debug information revealed sensitive information from environment variables in error log. This issue has been patched in versions 2024.04.7, 2023.10.15, 2022.10.13 and 2021.10.22...

MAL-2024-3973 Malicious code in xsolla-commerce-sdk (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in xsolla-commerce-sdk (npm)

--- -= Per source details. Do not edit below this line.=-...

PT-2024-37520

Name of the Vulnerable Software and Affected Versions: WordPress plugins affected versions not specified Description: A malicious threat actor has compromised the source code of various WordPress plugins hosted on WordPress.org, injecting malicious PHP scripts. These scripts exfiltrate database...

OpenCart SQL Injection Vulnerability (CNVD-2024-30072)

OpenCart is an open source online store management system for creating and managing e-commerce websites. It is known for its user-friendliness and flexibility for online stores of different sizes. OpenCart suffers from an SQL injection vulnerability that stems from the presence of an SQL injectio...

PrestaShop Security Breach

PrestaShop is an open source e-commerce solution from the American company PrestaShop. The solution provides multiple payment methods, short message alerts and product image zoom. A security vulnerability previously existed in PrestaShop axepta version 1.3.4, which stemmed from a lack of privileg...