Optimizely Configured Commerce security vulnerabilities

Optimizely Configured Commerce is a combined commerce platform from Optimizely, Inc. A security vulnerability exists in Optimizely Configured Commerce versions prior to 5.2.2408 that stems from allowing storefront visitors to purchase discontinued products...

Optimizely Configured Commerce security vulnerabilities

Optimizely Configured Commerce is a combined commerce platform from Optimizely, Inc. A security vulnerability exists in Optimizely Configured Commerce versions prior to 5.2.2408, which stems from the ability to disclose information about authenticated sessions...

PT-2025-4480 · Optimizely · Optimizely Configured Commerce

Name of the Vulnerable Software and Affected Versions: Optimizely Configured Commerce versions prior to 5.2.2408 Description: A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific...

PT-2025-4483 · Optimizely · Optimizely Configured Commerce

Name of the Vulnerable Software and Affected Versions: Optimizely Configured Commerce versions prior to 5.2.2408 Description: A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session,...

PT-2025-4482 · Optimizely · Optimizely Configured Commerce

Name of the Vulnerable Software and Affected Versions: Optimizely Configured Commerce versions prior to 5.2.2408 Description: A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tied to...

CVE-2025-22383

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity input validation issue exists in the Commerce B2B application, affecting the Contact Us functionality. This allows visitors to send e-mail messages that could contain unfiltered HTML markup in specific...

CVE-2025-22387: Use of GET Request Method With Sensitive Query Strings

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session, which can be leveraged for session hijacking...

CVE-2025-22387

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session, which can be leveraged for session hijacking...

WordPress Store Commerce theme <= 1.2.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Michael Patchstack Alliance in WordPress Theme Store Commerce versions = 1.2.3...

CVE-2024-49687: Missing Authorization

Missing Authorization vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce.This issue affects Smart Manager: from n/a through = 8.45.0...

CVE-2024-12884

A vulnerability was found in Codezips E-Commerce Website 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been...

CVE-2024-12884 Codezips E-Commerce Website login.php sql injection

A vulnerability was found in Codezips E-Commerce Website 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been...

CVE-2024-12884 Codezips E-Commerce Website login.php sql injection

A vulnerability was found in Codezips E-Commerce Website 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been...

CVE-2024-12884

CVE-2024-12884 affects Codezips E-Commerce Website 1.0. The vulnerability is an SQL injection in the login.php function triggered by manipulating the email parameter, allowing remote exploitation. Multiple connected sources corroborate the issue and describe it as critical, with exploitation disc...

CVE-2024-12884: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Codezips E-Commerce Website 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been...

Codezips E-Commerce Website has a vulnerability

Codezips E-Commerce Website is an open source e-commerce website by Codezips. An injection vulnerability exists in Codezips E-Commerce Website version 1.0, which originates from an SQL injection in the parameter email...

PT-2024-17775 · Unknown · Codezips E-Commerce Site

Name of the Vulnerable Software and Affected Versions: Codezips E-Commerce Website version 1.0 Description: A critical issue affects some unknown functionality of the file /login.php. The manipulation of the email argument leads to SQL injection. The attack may be launched remotely. The exploit h...

WordPress Custom Product Tabs For WooCommerce plugin <= 1.2.4 - Authenticated (Shop Manager+) PHP Object Injection vulnerability

Authenticated Shop Manager+ PHP Object Injection vulnerability discovered by Francesco Carlucci in WordPress Plugin Custom Product Tabs For WooCommerce versions = 1.2.4...

CVE-2024-12794

A vulnerability, which was classified as critical, was found in Codezips E-Commerce Site 1.0. This affects an unknown part of the file /admin/editorder.php. The manipulation of the argument dstatus/quantity/ddate leads to sql injection. It is possible to initiate the attack remotely. The exploit...

CVE-2024-12791

A vulnerability was found in Codezips E-Commerce Site 1.0. It has been rated as critical. This issue affects some unknown processing of the file signin.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the...