McMurtrey/Whitaker & Associates Cart32 3.0/3.1/3.5 Path Disclosure Vulnerability

No description provided by source. source : http://www.securityfocus.com/bid/1932/info Cart32 is a shopping cart application for e-commerce enabled sites. Cart32 contains a vulnerability which reveals server information. Requesting a specially crafted URL, by way of the CGI application, will reve...

Valdersoft Shopping Cart 3.0 - Multiple Remote File Include Vulnerabilities

No description provided by source. Valdersoft Shopping Cart v3.0 E-Commerce Software commonIncludePath Remote File Include +class : Remote File Include Vulnerability +Author : mdx +Files : +/commoninclude/common.php , /include/common.php, /admin/include/common.php +code : + + include...

CyberShop Ultimate E-commerce Multiple Cross-Site Scripting Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/16473/info CyberShop Ultimate E-commerce is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage...

JShop E-Commerce Suite 3.0 - Page.PHP Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/11003/info Reportedly the JShop E-Commerce Suite is affected by a cross-site scripting vulnerability in the 'page.php' script. This issue is due to a failure of the application to properly santitize user-supplied input. A...

TalentSoft Web+ 4.x Directory Traversal Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1102/info Web+ is an e-commerce server designed to run under a webserver, to provide web storefronts. The various scripts that are required to do this are specified to the webpsvr daemon via a 'script' variable passed to...

Fashione E-Commerce Webshop Multiple SQL Injection Vulnerability

No description provided by source. / / / / / / / / / / // / / / / ///// // Exploit Title: Fashione E-Commerce Webshop Multiple SQL Injection Vulnerabilities Date: 2010-09-19 Author: secret Contact : [email protected] / ICQ : 17-33-77 Site : swissfaking.net/board Software Link:...

cpcommerce 1.1.0 (xss/lfi) Multiple Vulnerabilities

No description provided by source. www.BugReport.ir AmnPardaz Security Research Team Title: cpCommerce Multiple Vulnerabilities Vendor: http://cpcommerce.cpradio.org Bugs: XSS, SQL Injection , Local File Inclusion Vulnerable Version: 1.1.0 prior versions also may be affected Exploitation: Remote...

PayPal Inc BB #74 - Persistent Core Backend Vulnerability

Document Title: =============== PayPal Inc BB 74 - Persistent Core Backend Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1278 PayPal Inc Security UID: cDc49dT Vulnerability Magazine Article:...

struts2 high-risk vulnerabilities, or may lead the Internet Security disaster-vulnerability warning-the black bar safety net

2 0 1 3 year 7 month 1 7 day is a many security operations, hackers sleepless nights...... Struts2 high-risk vulnerabilities to cause massive information leakage will affect countless Internet users, probably no one will be spared......） To exploit the vulnerability, a hacker can initiate remote...

eBay Hacked, Change your Account Password Now

If you have an eBay Account then you should change your password immediately, because the World's biggest E-commerce company with 128 million active users announced today in a press release that it had been Hacked. eBay revealed that attackers compromised customers' database including emails,...

PayPal Filter Bypass

Document Title: =============== Paypal Inc Bug Bounty 109 MOS - Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1050 PayPal Security UID: Pq115cey Release Date: ============= 2014-05-14 Vulnerability Laboratory ID VL-ID:...

CVE-2013-5916

Cross-site scripting XSS vulnerability in falha.php in the Bradesco Gateway plugin 2.0 for Wordpress, as used in the WP e-Commerce plugin, allows remote attackers to inject arbitrary web script or HTML via the QUERYSTRING...

CVE-2013-5916: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in falha.php in the Bradesco Gateway plugin 2.0 for Wordpress, as used in the WP e-Commerce plugin, allows remote attackers to inject arbitrary web script or HTML via the QUERYSTRING...

WordPress iMember360is 3.9.001 XSS / Disclosure / Code Execution

WordPress iMember360is plugin versions 3.8.012 through 3.9.001 suffers from arbitrary code execution, database credential disclosure, arbitrary user deletion, and cross site scripting vulnerabilities. ------------ BACKGROUND ------------ "iMember360is a WordPress plugin that will turn a normal...

WP e-Commerce Swipe <= 3.1.0 - Multiple XSS Issues

The last time it was checked the plugin was still affected and had been closed. PoC...

WP e-Commerce Swipe <= 3.1.0 - Multiple XSS Issues

The last time it was checked the plugin was still affected and had been closed...

PrestaShop 1.5.6.2 Cross Site Scripting

Cross Site Scripting on E-Commerce PrestaShop Risk: Low CWE number: CWE-79 Date: 09/04/2014 Vendor: www.prestashop.com Version: PrestaShop 1.5.6.2 Author: Felipe "Renzi" Gabriel Contact: [email protected] Tested on Windows 8 pro Vulnerable File: product.php Exploit:...

Cosmoshop 'pwd.cgi'任意文件创建漏洞

Bugtraq ID:66323 CosmoShop是基于Magento的云电商系统。 攻击者可通过使用特制的请求利用该漏洞在服务器上创建任意文件。 0 Cosmoshop 目前没有详细解决方案： http://www.cosmoshop.de/...

Monoprice.com Cart Enumeration

As similarly stated at http://nmap.org/mailman/listinfo/fulldisclosure I would appreciate if Monoprice.com better secures its ecommerce site by fixing the following flaw rather than hiding it. With no cookies, visiting http://www.monoprice.com/Cart yields an empty cart with no cart id . Adding an...

OXID eShop 'index.php'多个HTTP应答拆分漏洞

Bugtraq ID:66371 CVE ID:CVE-2014-2017 OXID eShop又名OXID eSales是一个e-commerce系统,采用PHP开发,使用MySQL来存储数据。 通过"anid", "cnid"和"listtype"参数传递给index.php的输入在用于限制HTTP头字段时缺少过滤，允许远程攻击者利用漏洞把包含任意HTTP头的应答发送给用户。 0 OXID eShop 4.x OXID eShop 5.x OXID eShop Professional, Community或Enterprise version 4.7.11/5.0.11 and...