CVE-2023-5952 Welcart e-Commerce < 2.9.5 - Unauthenticated PHP Object Injection

The Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Object Injection when a suitable gadget is present on the blog...

PT-2023-32441 · WordPress · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce WordPress plugin versions prior to 2.9.5 Description: The issue arises from the lack of file validation for uploads and the absence of authorization and CSRF protection in an AJAX action handling file uploads. This allows a...

PT-2023-32440 · WordPress · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce WordPress plugin versions prior to 2.9.5 Description: The issue allows unauthorized users to perform PHP Object Injection when a suitable gadget is present on the blog, due to the plugin unserializing user input from cookie...

WordPress plugin Welcart e-Commerce security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

PT-2023-9137 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier Description: The issue is related to a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts...

WordPress plugin Welcart e-Commerce security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

Information Disclosure

oro/commerce is vulnerable to Information Disclosure. The vulnerability allows back-office users to bypass access control ACL restrictions and access detailed order totals information by simply knowing the order ID...

CVE-2023-32065

OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order totals information may be received by Order ID. This issue is patched in version 5.0.11 and 5.1.1...

CVE-2023-32065

CVE-2023-32065 affects OroCommerce where the get-totals-for-checkout API endpoint can disclose detailed order totals to users who should not have access, by exploiting inadequate access control around Order IDs. Public sources in the connected documents describe an information-disclosure path ena...

CVE-2023-4406

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in KC Group E-Commerce Software allows Reflected XSS. This issue affects E-Commerce Software: through 20231123. NOTE: The vendor was contacted early about this disclosure but did not respond in any wa...

CVE-2023-4406

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in KC Group E-Commerce Software allows Reflected XSS. This issue affects E-Commerce Software: through 20231123. NOTE: The vendor was contacted early about this disclosure but did not respond in any wa...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in KC Group E-Commerce Software allows Reflected XSS.This issue affects E-Commerce Software: through 20231123. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2023-4406

CVE-2023-4406 is a Reflected XSS vulnerability in KC Group E-Commerce Software affecting versions through 20231123. The root cause is improper neutralization of input during web page generation. Multiple sources (NVD, Red Hat, CNNVD, PRION, CVELIST, VulnEnrichment) corroborate that the issue exis...

CVE-2023-4406 XSS in KC Group's E-Commerce Software

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in KC Group E-Commerce Software allows Reflected XSS. This issue affects E-Commerce Software: through 20231123. NOTE: The vendor was contacted early about this disclosure but did not respond in any wa...

CVE-2023-4406 XSS in KC Group's E-Commerce Software

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in KC Group E-Commerce Software allows Reflected XSS. This issue affects E-Commerce Software: through 20231123. NOTE: The vendor was contacted early about this disclosure but did not respond in any wa...

PT-2023-29084 · Unknown · Kc Group E-Commerce

Name of the Vulnerable Software and Affected Versions: KC Group E-Commerce Software versions through 20231123 Description: The issue affects the KC Group E-Commerce Software, allowing for Reflected XSS due to improper neutralization of input during web page generation. The vendor was contacted...

SAHU TikTok Pixel for E-Commerce <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

Description The SAHU TikTok Pixel for E-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Fortify Your Online Business – Security Tips for Starting an e-Commerce Website

By Owais Sultan E-commerce is a lucrative business, but it requires hard work and robust cybersecurity. This is a post from HackRead.com Read the original post: Fortify Your Online Business - Security Tips for Starting an e-Commerce Website...

The dark side of Black Friday: decoding cyberthreats around the year’s biggest shopping season

As the annual Black Friday approaches, the digital landscape experiences an unprecedented surge in e-commerce and online shopping activity. Major sales aside, e-commerce is still a huge market. In 2022, global e-commerce retail revenue was estimated to reach $5.7 trillion worldwide, marking nearl...

OpenCart Authorization Issues Vulnerability (CNVD-2024-30067)

OpenCart is an open source e-commerce system from the OpenCart team in Hong Kong, China. The system provides product reviews, product ratings, product additions and other modules. OpenCart suffers from an authorization issue vulnerability that arises from allowing a back-end user with...