CVE-2024-37295

Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version...

CVE-2024-37296

The Aimeos HTML client provides Aimeos HTML components for e-commerce projects. Starting in version 2020.04.1 and prior to versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5, digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment...

CVE-2024-37295

CVE-2024-37295 affects the Aimeos core framework. Versions before 2024.04.5 (starting from 2024.01.1) allow an admin to upload files that appear image-like but contain PHP code, which can be executed in the web server context (remote code execution). The issue is fixed in 2024.04.5. CVSS v3.1 bas...

CVE-2024-37295 Aimeos Core remote code execution in web server context

Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version...

CVE-2024-37294 Aimeos denial of service vulnerability in SaaS and marketplace setups

Aimeos is an Open Source e-commerce framework for online shops. All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack. Users should upgrade to versions 2022.10.17, 2023.10.17, or 2024.04 of the aimeos/aimeos-core package to...

CVE-2024-37294

CVE-2024-37294 – Aimeos denial of service . The vulnerability affects all SaaS and marketplace deployments using Aimeos in versions 2022, 2023, and 2024. The underlying issue leads to a potential denial of service, with a base CVSS v3.1 score of 5.5 (Network, Privileges Required: High, User Inter...

WordPress plugin Welcart e-Commerce security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-24440 · Unknown · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce versions 2.9.14 and earlier Description: The issue is related to a Missing Authorization vulnerability in Welcart e-Commerce. Recommendations: For versions 2.9.14 and earlier, update to a version that contains a fix for thi...

Number withdrawn

Aimeos is an open source e-commerce framework for online stores from Aimeos Open Source. This CVE number has been withdrawn...

JVN#15637138: EC-Orange vulnerable to authorization bypass

EC-Orange provided by S-cubism Inc. is an e-commerce website building system package based on an open source software EC-CUBE. EC-Orange contains an authorization bypass vulnerability CWE-639. This is the same issue as JVN51770585 EC-CUBE vulnerable to authorization bypass. Impact A user of the...

WordPress Plugin Exploited to Steal Credit Card Data from E-commerce Sites

Unknown threat actors are abusing lesser-known code snippet plugins for WordPress to insert malicious PHP code in victim sites that are capable of harvesting credit card data. The campaign, observed by Sucuri on May 11, 2024, entails the abuse of a WordPress plugin called Dessky Snippets, which...

BIT-PRESTASHOP-2024-34717 Anonymous PrestaShop customer can download other customers' invoices

PrestaShop is an open source e-commerce web application. In PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random securekey parameter in the url. This issue is patched in version 8.1.6. No known workarounds are available...

CVE-2024-5049

A vulnerability, which was classified as critical, has been found in Codezips E-Commerce Site 1.0. Affected by this issue is some unknown functionality of the file admin/editproduct.php. The manipulation of the argument profilepic leads to unrestricted upload. The attack may be launched remotely...

CVE-2024-5049

CVE-2024-5049 affects Codezips E-Commerce Site 1.0. The vulnerability is in admin/editproduct.php where manipulating the profilepic parameter leads to unrestricted file upload, enabling remote abuse. The issue is tied to unknown functionality in the editproduct.php handling of profilepic, enablin...

CVE-2024-5049 Codezips E-Commerce Site editproduct.php unrestricted upload

A vulnerability, which was classified as critical, has been found in Codezips E-Commerce Site 1.0. Affected by this issue is some unknown functionality of the file admin/editproduct.php. The manipulation of the argument profilepic leads to unrestricted upload. The attack may be launched remotely...

CVE-2024-5049 Codezips E-Commerce Site editproduct.php unrestricted upload

A vulnerability, which was classified as critical, has been found in Codezips E-Commerce Site 1.0. Affected by this issue is some unknown functionality of the file admin/editproduct.php. The manipulation of the argument profilepic leads to unrestricted upload. The attack may be launched remotely...

PT-2024-34267 · Unknown · Codezips E-Commerce Site

Name of the Vulnerable Software and Affected Versions: Codezips E-Commerce Site version 1.0 Description: A critical issue has been found in the software, affecting some unknown functionality of the file admin/editproduct.php. The manipulation of the profilepic argument leads to unrestricted uploa...

E-Commerce Site 代码问题漏洞

E-Commerce Site is an e-commerce website. A code issue vulnerability exists in E-Commerce Site version 1.0, which stems from the parameter profilepic in the file admin/editproduct.php that can cause unrestricted uploads...

CVE-2024-4923

A vulnerability has been found in Codezips E-Commerce Site 1.0 and classified as critical. This vulnerability affects unknown code of the file admin/addproduct.php. The manipulation of the argument profilepic leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...

CVE-2024-4923 Codezips E-Commerce Site addproduct.php unrestricted upload

A vulnerability has been found in Codezips E-Commerce Site 1.0 and classified as critical. This vulnerability affects unknown code of the file admin/addproduct.php. The manipulation of the argument profilepic leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...