ricerca-tesi

ricerca-tesi recursos de investigación para cve-2026-7228 Herramientas Instalación de virtual-box instalación de virtual-box: https://www.virtualbox.org/wiki/Downloads Instalación de iso windows 11 https://www.microsoft.com/it-it/software-download/windows11 Instalación de distro linux: lubuntu...

oss-oopssec-store

OSS - OopsSec Store Security training for the apps you actually ship. 36 challenges across web, API, authentication, business logic, cryptography, supply chain, AI agents and MCP. Break a deliberately vulnerable e-commerce app built on Next.js, React, TypeScript and Prisma. Find the bugs. Exploit...

CVE-2025-7461

Modern Bag 电商系统 SQL 注入漏洞分析 CVE-2025-7461 🌐 Language / 语言 : English | 简体中文 漏洞概览 漏洞库： https://vuldb.com/?id.316112 项目地址： https://code-projects.org/modern-bag-in-php-css-javascript-and-mysql-free-download/ 项目| 内容 ---|--- 产品名称| Modern Bag 电商系统 版本| V1.0 漏洞类型| SQL 注入 Boolean-based blind, Error-based,...

CVE-2021-39475

CVE-2021-39475 管理后台评论页面上的XSS漏洞 https://www.warcloudsecurity.com/ecommerce/admin/reviews.php?action=preview&rID=1&page=0...

EUVD-2026-77128

A vulnerability was detected in jaygajera17 E-commerce-project-springBoot up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. The impacted element is the function UserController.updateUser of the file UserController.java. Performing a manipulation of the argument userid results in authorization bypas...

CVE-2026-90598

A vulnerability was detected in jaygajera17 E-commerce-project-springBoot up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. The impacted element is the function UserController.updateUser of the file UserController.java. Performing a manipulation of the argument userid results in authorization bypas...

CVE-2025-29722

🛡️ CVE-2025-29722 – Commercify v1.0 中的跨站请求伪造（CSRF）漏洞 发现者：David P.S Abraham（又名 Davycipher） CVE 编号 CVE-2025-29722 已由 MITRE Corporation 分配给此漏洞。 摘要 在 Commercify v1.0 中发现了一个 CSRF 漏洞 ，这是一个由 @yassmittal 开发的开源电子商务平台。该应用在 /updatesettings 等关键端点上缺少适当的 CSRF 防护机制，攻击者可在其他域名下构造恶意请求来修改用户数据。 受影响产品 产品名称： Commercify...

CVE-2026-7298

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in IdeaSoft Software Industry and Trade Inc. Smart E-Commerce allows Reflected XSS. This issue affects Smart E-Commerce: through 11092026. NOTE: The vendor was contacted early about this disclosure bu...

CVE-2026-7298 Reflected XSS in IdeaSoft's Smart E-Commerce

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in IdeaSoft Software Industry and Trade Inc. Smart E-Commerce allows Reflected XSS. This issue affects Smart E-Commerce: through 11092026. NOTE: The vendor was contacted early about this disclosure bu...

CVE-2026-7298

CVE-2026-7298 is a Reflected XSS vulnerability in IdeaSoft Smart E-Commerce (through version 11092026), caused by improper neutralization of input during web page generation. The CVSS 3.1 score is 6.1 (Medium) with a network attack vector, low complexity, no required privileges, but user interact...

EUVD-2026-76163

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in IdeaSoft Software Industry and Trade Inc. Smart E-Commerce allows Reflected XSS. This issue affects Smart E-Commerce: through 11092026. NOTE: The vendor was contacted early about this disclosure bu...

CVE-2025-61454

🛡️ Divulgación de CVE: CVE-2025-61454 — XSS Reflejado en Proyecto de Comercio Electrónico Fecha de divulgación: 14 de octubre de 2025 ID de CVE: CVE-2025-61454 Severidad: MEDIA CVSS 6.1 🧩 Resumen Existe una vulnerabilidad de Cross-Site Scripting XSS reflejado en el Proyecto de Comercio Electrónico...

CVE-2025-61456

🛡️ Divulgación de CVE: CVE-2025-61456 — XSS Reflejado en Proyecto de Comercio Electrónico Fecha de divulgación: 14 de octubre de 2025 ID de CVE: CVE-2025-61456 Severidad: MEDIA CVSS 6.1 🧩 Resumen Existe una vulnerabilidad de Cross-Site Scripting XSS reflejado en el Proyecto de Comercio Electrónico...

CVE-2025-61455

🛡️ Divulgación de CVE: CVE-2025-61455 — Inyección SQL en Proyecto de Comercio Electrónico Fecha de divulgación: 14 de octubre de 2025 ID de CVE: CVE-2025-61455 Gravedad: CRÍTICA CVSS 9.8 🧩 Resumen Existe una vulnerabilidad crítica de inyección SQL en E-commerce Project v1.0, específicamente en el...

CVE-2013-3651

CVE-2013-3651 PoC - EC-CUBE 2 使用 依赖 Python 3 执行 root@kitploit: $ python poccve20133651.py - e.g. $ python poccve20133651.py http://127.0.0.1:9000/ Result: Vulnerable! PoC 漏洞 | EC网站构建·改版（EC开放平台EC-CUBE） https://www.ec-cube.net/info/weakness/weakness.php?id=49 参考 JVNDB-2013-000062 - JVN iPedia...

CVE-2022-4140

CVE-2022-4140 - Plugin de WordPress Welcart e-Commerce 2.8.5 - Lectura arbitraria de archivos Este repositorio contiene un exploit de Prueba de Concepto PoC para CVE-2022-4140. Aviso legal Este proyecto se proporciona únicamente con fines educativos y para pruebas de seguridad autorizadas. No lo...

CVE-2026-19887

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback uscesactionactingtransaction. Unauthenticated attackers can store arbitrary 'reserve' key/value...

CVE-2026-19887

The Welcart e-Commerce plugin for WordPress (versions up to 2.12.1 ) is vulnerable to PHP Object Injection via the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attackers can store arbitrary serialized data as order metadata during a public checkout, then trigger...

CVE-2026-19887 Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback uscesactionactingtransaction. Unauthenticated attackers can store arbitrary 'reserve' key/value...

EUVD-2026-71883

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback uscesactionactingtransaction. Unauthenticated attackers can store arbitrary 'reserve' key/value...