ricerca-tesi

ricerca-tesi ресурсы для исследования cve-2026-7228 Инструменты Установка virtual-box установка virtual-box: https://www.virtualbox.org/wiki/Downloads Установка iso windows 11 https://www.microsoft.com/it-it/software-download/windows11 Установка дистрибутива linux: lubuntu...

CVE-2021-39475

CVE-2021-39475 XSS на странице отзывов администратора https://www.warcloudsecurity.com/ecommerce/admin/reviews.php?action=preview&rID=1&page=0...

CVE-2026-19887

The Welcart e-Commerce plugin for WordPress (versions up to 2.12.1 ) is vulnerable to PHP Object Injection via the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attackers can store arbitrary serialized data as order metadata during a public checkout, then trigger...

EUVD-2026-71883

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback uscesactionactingtransaction. Unauthenticated attackers can store arbitrary 'reserve' key/value...

oss-oopssec-store

OSS - OopsSec Store Намеренно уязвимое e-commerce приложение для изучения веб-безопасности. Освойте реальные векторы атак через реалистичную CTF-платформу. Охотьтесь за флагами, эксплуатируйте уязвимости и прокачивайте свои навыки в области безопасности. Docker Hub · npm · Roadmap · Walkthroughs ...

WordPress Welcart e-Commerce plugin <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback vulnerability

Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback vulnerability discovered by daroo in WordPress Plugin Welcart e-Commerce versions = 2.12.1...

CVE-2025-7461

Modern Bag 电商系统 SQL 注入漏洞分析 CVE-2025-7461 🌐 Language / 语言 : English | 简体中文 漏洞概览 漏洞库： https://vuldb.com/?id.316112 项目地址： https://code-projects.org/modern-bag-in-php-css-javascript-and-mysql-free-download/ 项目| 内容 ---|--- 产品名称| Modern Bag 电商系统 版本| V1.0 漏洞类型| SQL 注入 Boolean-based blind, Error-based,...

CVE-2025-29722

🛡️ CVE-2025-29722 – Межсайтовая подделка запроса CSRF в Commercify v1.0 Обнаружено: David P.S Abraham также известный как Davycipher CVE ID CVE-2025-29722 был присвоен этой уязвимости организацией MITRE Corporation. Краткое описание Уязвимость CSRF была обнаружена в Commercify v1.0 , платформе...

CVE-2025-61454

🛡️ CVE 공개: CVE-2025-61454 — 전자상거래 프로젝트의 반사형 XSS 공개 날짜: 2025년 10월 14일 CVE ID: CVE-2025-61454 심각도: 중간 CVSS 6.1 🧩 요약 E-commerce Project v1.0의 search.php 엔드포인트에 반사형 교차 사이트 스크립팅XSS 취약점이 존재합니다. search 매개변수의 무결화되지 않은 입력이 응답 HTML에 직접 반영되어, 공격자가 악성 링크를 방문하거나 조작된 요청을 제출한 사용자의 브라우저에서 임의의 JavaScript를 실행할 수...

CVE-2025-61456

🛡️ CVE 공개: CVE-2025-61456 — 전자상거래 프로젝트의 반사형 XSS 공개 날짜: 2025년 10월 14일 CVE ID: CVE-2025-61456 심각도: 중간 CVSS 6.1 🧩 요약 E-commerce Project v1.0의 index.php 엔드포인트에서 반사형 교차 사이트 스크립팅XSS 취약점이 발견되었습니다. URL 경로 매개변수의 무결화되지 않은 입력이 응답 HTML에 직접 반영되어, 공격자가 악성 링크를 방문하거나 조작된 요청을 제출한 사용자의 브라우저에서 임의의 JavaScript를 실행할 수...

CVE-2025-61455

🛡️ CVE 공개: CVE-2025-61455 — 전자상거래 프로젝트의 SQL 인젝션 공개 날짜: 2025년 10월 14일 CVE ID: CVE-2025-61455 심각도: CRITICAL CVSS 9.8 🧩 요약 E-commerce Project v1.0의 signup.inc.php 엔드포인트에 치명적인 SQL 인젝션 취약점이 존재합니다. 이 애플리케이션은 검증되지 않은 사용자 입력을 SQL 쿼리에 직접 포함하여, 인증되지 않은 공격자가 인증을 우회하고 임의의 SQL 명령을 실행할 수 있게 합니다. 이 문제에는...

CVE-2013-3651

CVE-2013-3651 PoC - EC-CUBE 2 Использование Требования Python 3 Выполнение root@kitploit: $ python poccve20133651.py - например $ python poccve20133651.py http://127.0.0.1:9000/ Результат: Уязвим! PoC Уязвимость | Создание и обновление EC-сайтов с помощью «EC-CUBE»...

CVE-2026-19914

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customorder' parameter in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

EUVD-2026-68997

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customorder' parameter in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2026-19914

Welcart e-Commerce (WordPress plugin) has a Stored Cross-Site Scripting vulnerability via the custom_order parameter , affecting all versions up to and including 2.12.1 . The root cause is insufficient input sanitization and output escaping . Unauthenticated attackers can inject arbitrary scripts...

CVE-2026-19914 Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customorder' parameter in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

WordPress Welcart e-Commerce plugin <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'customorder' Parameter vulnerability discovered by Afifudin Maarif in WordPress Plugin Welcart e-Commerce versions = 2.12.1...

CVE-2026-5800

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platform allows Reflected XSS. This issue affects E-Commerce Platform: through 28082026. NOTE: The vendor was contacted early about this disclosu...

CVE-2026-4378

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Akilli Ticaret Software Technologies Ltd. E-Commerce Pack allows Stored XSS. This issue affects E-Commerce Pack: from 4.5.001 before 4.6.001...

EUVD-2026-67740

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Akilli Ticaret Software Technologies Ltd. E-Commerce Pack allows Stored XSS. This issue affects E-Commerce Pack: from 4.5.001 through 28082026. NOTE: The vendor was contacted early about this...