Business Logic Errors in microweber/microweber

A vulnerability has been identified in microweber where users can purchase items with a coupon code. If the admin disables the use of the coupon code functionality, but the user sends requests to the API that handles the coupon code, the user can exploit the vulnerability and obtain items at a...

GHSA-QJFX-FVX7-3WVW Business Logic Errors in microweber/microweber

A vulnerability has been identified in microweber where users can purchase items with a coupon code. If the admin disables the use of the coupon code functionality, but the user sends requests to the API that handles the coupon code, the user can exploit the vulnerability and obtain items at a...

PT-2023-32783 · Microweber · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 2.0 Description: A vulnerability has been identified in microweber where users can exploit business logic errors to obtain items at a lower price. This occurs when the admin disables the use of the coup...

CVE-2023-47308

In the module "Newsletter Popup PRO with Voucher/Coupon code" newsletterpop before version 2.6.1 from Active Design for PrestaShop, a guest can perform SQL injection in affected versions. The method NewsletterpopsendVerificationModuleFrontController::checkEmailSubscription has sensitive SQL calls...

PT-2023-17007 · WordPress · Wp Express Checkout

Name of the Vulnerable Software and Affected Versions: WP Express Checkout plugin for WordPress versions up to, and including, 2.2.8 Description: The issue is related to Stored Cross-Site Scripting via the pec couponcode parameter due to insufficient input sanitization and output escaping. This...

No Rate Limit on Copoun Code Functionality

Description The attacker has the ability to send any number of requests to the endpoint due to the absence of rate-limiting. Steps to reproduce - Simply capture the adding coupon request and send it to burp. - Send it to the repeater tab and you will be able to send many requests without blocking...

LifterLMS < 4.21.1 - Reflected Cross-Site Scripting (XSS) via Coupon Code in Checkout

The plugin did not properly sanitise the coupon code during checkout before outputting in back the error message in the page, leading to a reflected Cross-Site Scripting issue...

How to Avoid Spam—Using Disposable Contact Information

The next time you sign up for a coupon code or retail promotion, use these apps to avoid spam text and email messages...

Top 5 Last-Minute Memorial Day Deals at THN Store → Get 60% Extra OFF

Memorial Day has come and gone, but you still have time to land some of the best deals on some of the best apps and tech training bundles around. Whether you're looking for a world-class VPN or want to begin a career as a high-paid ethical hacker or IT pro, this list of ultra-discounted apps and...

WordPress MemberMouse SQL Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL servers to set up personal blog sites.MemberMouse plugin is used in one of the sales management plugin. A SQL injection vulnerability exists in the...

CVE-2018-11309

Blind SQL injection in couponcode in the MemberMouse plugin 2.2.8 and prior for WordPress allows an unauthenticated attacker to dump the WordPress MySQL database via an applyCoupon action in an admin-ajax.php request...

Get the passenger and the owner of the personal information? This note Uber logical vulnerability“combination punches”worth a look-vulnerability warning-the black bar safety net

! Uber recently finally opened up its vulnerability reward program, and encourage white-hat gate expand on the Uber online service vulnerability mining. Please with FreeBuf xiaobian together look at this a few logical loopholes the formation of“combination of Boxing” it. Information collected...

Udemy: Able to view others' gifts on /gift/share URL, giftId is predictable, and easy to manipulate

I recently purchased a gift for a friend, and noticed the share URL gift ID was simply numeric. I managed to access other people's gifts simply by incrementing and decrementing the ID by 2, I was able to verify that the price was dropped to "Free", regardless of if I was logged in or not, and I w...

Interspire Shopping Cart v6 - Multiple Web Vulnerabilities

Document Title: =============== Interspire Shopping Cart v6 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=593 Release Date: ============= 2012-06-02 Vulnerability Laboratory ID VL-ID: ====================================...

CVE-2011-5082

Cross-site scripting XSS vulnerability in the s2Member Pro plugin before 111220 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s2memberproauthnetcheckoutcoupon parameter aka Coupon Code field...

Cross site scripting

Cross-site scripting XSS vulnerability in the s2Member Pro plugin before 111220 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s2memberproauthnetcheckoutcoupon parameter aka Coupon Code field...

CVE-2011-5082

Cross-site scripting XSS vulnerability in the s2Member Pro plugin before 111220 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s2memberproauthnetcheckoutcoupon parameter aka Coupon Code field...