WPBookit <= 1.0.8 - Unauthenticated Customer Information Disclosure

WPBookit WordPress plugin = 1.0.8 contains an information disclosure vulnerability caused by missing authorization check on 'getcustomerlist' route, letting unauthenticated attackers retrieve sensitive customer data. id: CVE-2026-1980 info: name: WPBookit = 1.0.8 - Unauthenticated Customer...

WP Booking System <= 2.1.0.3 - Unauthenticated Email Log Disclosure

WP Booking System – Booking Calendar plugin for WordPress = 2.1.0.3 contains an authorization bypass caused by improper user authorization verification, letting unauthenticated attackers read stored notification emails exposing customer PII, exploit requires authenticated Subscriber-level user. i...

Magento-APSB22-48-Security-Patches

Official Magento Patches have been released:Magento Docs These patches address the same security issues as this repository does. Except that we've added a few fixes to older Magento versions. Security patches for APSB22-48 This repository contains Magento 2 Patch Files for the recently found...

Vulnerability-Playground-CVE-2025-61922

Vulnerability-Playground-CVE-2025-61922 This playground simulates the Customer Checkout vulnerability in PrestaShop...

customer-assistance-buttons-sdr

Customer Assistance Buttons Research This repository houses the work that ive put into reversing the various encoders and protocols used for customer service buttons in retail shops such as Walgreens, CVS, Lowes, and Home Depot Each retailer is broken out into it's own folder, and within that...

CVE-2023-50070

CVE-2023-50070 Customer Support System 1.0 - Multiple SQL injection vulnerabilities - saveticket Description : Multiple SQL injection vulnerabilities in /customersupport/ajax.php?action=saveticket in Customer Support System 1.0 allow authenticated attackers to execute arbitrary SQL commands via...

CVE-2023-50071

CVE-2023-50071 Customer Support System 1.0 - Multiple SQL injection vulnerabilities - savedepartment Description : Multiple SQL injection vulnerabilities in /customersupport/ajax.php?action=savedepartment in Customer Support System 1.0 allow authenticated attackers to execute arbitrary SQL comman...

CVE-2026-120205

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related...

CVE-2026-120205 Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related...

CVE-2026-120205 Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related...

CVE-2026-120205

The Thelia software (versions prior to 3.1.0 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in the ForSomeCustomers::getSummary() function. The root cause is the handling of unescaped customer names , allowing unauthenticated attackers to register with a script payload as their name....

CVE-2023-51281

CVE-2023-51281 Customer Support System 1.0 - Multiple Cross-Site Scripting XSS Vulnerability in “firstname”, "lastname", "middlename", "contact" or “address” parameters Description : Multiple cross-site scripting XSS vulnerabilities in /customersupport/ajax.php?action=savecustomer in Customer...

CVE-2023-49970

CVE-2023-49970 Customer Support System 1.0 - SQL Injection Vulnerability in the "subject" Parameter During "saveticket" Operation Description : A SQL Injection vulnerability exists in version 1 of the Customer Support System. A malicious attacker can issue SQL commands to the MySQL database when...

CVE-2023-49973

CVE-2023-49973 Customer Support System 1.0 - Cross-Site Scripting XSS Vulnerability in "email" field/parameter on "customerlist" Page Description : Customer Support System 1.0 is vulnerable to stored XSS. A XSS vulnerability exists in version 1 of the Customer Support System. A malicious actor ca...

CVE-2023-49546

CVE-2023-49546 Customer Support System 1.0 - SQL Injection Vulnerability in the "email" Parameter During "savestaff" Operation Description : A SQL Injection vulnerability exists in version 1 of the Customer Support System. A malicious attacker can issue SQL commands to the MySQL database when...

CVE-2023-49968

CVE-2023-49968 Customer Support System 1.0 - SQL Injection Vulnerability in managedepartment.php via "id" URL Parameter Description : A SQL Injection vulnerability exists in version 1 of the Customer Support System. An attacker with malicious intent can execute SQL commands on the MySQL database ...

CVE-2023-49977

CVE-2023-49977 Customer Support System 1.0 - Cross-Site Scripting XSS Vulnerability in "Address" field/parameter on "customerlist" Page Description : Customer Support System 1.0 is vulnerable to stored XSS. A XSS vulnerability exists in version 1 of the Customer Support System. A malicious actor...

CVE-2023-49969

CVE-2023-49969 Customer Support System 1.0 - SQL Injection Vulnerability in editcustomer via "id" URL Parameter Description : A SQL Injection vulnerability exists in version 1 of the Customer Support System. An attacker with malicious intent can execute SQL commands on the MySQL database by...

CVE-2023-49971

CVE-2023-49971 Customer Support System 1.0 - Cross-Site Scripting XSS Vulnerability in "firstname" field/parameter on "customerlist" Page Description : Customer Support System 1.0 is vulnerable to stored XSS. A XSS vulnerability exists in version 1 of the Customer Support System. A malicious acto...

CVE-2023-49548

CVE-2023-49548 Customer Support System 1.0 - SQL Injection Vulnerability in the "lastname" Parameter During "saveuser" Operation Description : A SQL Injection vulnerability exists in version 1 of the Customer Support System. A malicious attacker can issue SQL commands to the MySQL database when...