8777 matches found
WordPress plugin Welcart e-Commerce 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...
PT-2023-14111 · WordPress · Welcart E-Commerce
Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce WordPress plugin versions prior to 2.8.6 Description: The issue arises from the lack of validation of user input before using it in file exist functions via various AJAX actions available to any authenticated users. This...
PT-2023-14110 · WordPress · Welcart E-Commerce
Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce WordPress plugin versions prior to 2.8.5 Description: The issue concerns the Welcart e-Commerce WordPress plugin, which does not validate user input before using it to output the content of a file via an AJAX action availab...
WordPress plugin Welcart e-Commerce 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...
PT-2023-7910 · WordPress · Welcart E-Commerce
Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce WordPress plugin versions prior to 2.8.5 Description: The issue is related to the use of files and directories accessible to external parties. It does not validate user input before using it to output the content of a file,...
WordPress plugin has been exploited in the wild to mount backdoors
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Malicious actors are actively exploiting a critical vulnerability in the YITH WooCommerce Gift Cards Premium WordPress plugin in order to plant backdoors on e-Commerce sites. The security flaw...
Unspecified vulnerability in baijiacms
baijiacms is a content management system CMS for e-commerce. A security vulnerability exists in the baijiacms version, which stems from a Remote Code Execution RCE vulnerability in includes/baijiacms/common.inc.php. No details of the vulnerability are available at this time...
Accelerate Your Incident Response
Tis the season for security and IT teams to send out that company-wide email: "No, our CEO does NOT want you to buy gift cards." As much of the workforce signs off for the holidays, hackers are stepping up their game. We'll no doubt see an increase in activity as hackers continue to unleash...
Welcart e-Commerce < 2.8.9 - Contributor+ Stored XSS via Shortcode
The plugin does not validate and escapes one of its shortcode attributes, which could allow users with a role as low as a contributor to perform a Stored Cross-Site Scripting attack. 1. Add a product item to the plugin. The item name, for example, "first". You will also use this in the shortcode...
Welcart e-Commerce < 2.8.9 - Contributor+ Stored XSS via Shortcode
The plugin does not validate and escapes one of its shortcode attributes, which could allow users with a role as low as a contributor to perform a Stored Cross-Site Scripting attack. PoC 1. Add a product item to the plugin. The item name, for example, "first". You will also use this in the...
Shoplazza LifeStyle 安全漏洞
Shoplazza LifeStyle is an e-commerce website by Shoplazza, Inc. A security vulnerability exists in Shoplazza LifeStyle version 1.1. An attacker could exploit the vulnerability to perform cross-site scripting attacks...
CVE-2022-41266
Due to a lack of proper input validation, SAP Commerce Webservices 2.0 Swagger UI - versions 1905, 2005, 2105, 2011, 2205, allows malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a DOM Cross-Site Scripting XSS attack. As a result, an attacker may be able t...
CVE-2022-41266
Due to a lack of proper input validation, SAP Commerce Webservices 2.0 Swagger UI - versions 1905, 2005, 2105, 2011, 2205, allows malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a DOM Cross-Site Scripting XSS attack. As a result, an attacker may be able t...
Cross site scripting
Due to a lack of proper input validation, SAP Commerce Webservices 2.0 Swagger UI - versions 1905, 2005, 2105, 2011, 2205, allows malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a DOM Cross-Site Scripting XSS attack. As a result, an attacker may be able t...
CVE-2022-41266
Due to a lack of proper input validation, SAP Commerce Webservices 2.0 Swagger UI - versions 1905, 2005, 2105, 2011, 2205, allows malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a DOM Cross-Site Scripting XSS attack. As a result, an attacker may be able t...
CVE-2022-41266
CVE-2022-41266 affects SAP Commerce Webservices 2.0 (Swagger UI) across versions 1905, 2005, 2105, 2011, 2205. The root cause is a lack of proper input validation which allows malicious inputs to trigger a DOM XSS . Impact described in sources includes token theft and potential full account takeo...
CVE-2022-41266
Due to a lack of proper input validation, SAP Commerce Webservices 2.0 Swagger UI - versions 1905, 2005, 2105, 2011, 2205, allows malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a DOM Cross-Site Scripting XSS attack. As a result, an attacker may be able t...
PT-2022-25777 · Sap · Sap Commerce Webservices
Name of the Vulnerable Software and Affected Versions: SAP Commerce Webservices 2.0 Swagger UI versions 1905, 2005, 2105, 2011, 2205 Description: The issue is due to a lack of proper input validation, allowing malicious inputs from untrusted sources. This can be leveraged by an attacker to execut...
CVE-2022-3935
The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks...