795 matches found
CVE-2021-20825
Cross-site scripting vulnerability in List order management item change plug-in for EC-CUBE 3.0 series Ver.1.1 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors...
CVE-2021-20825
Cross-site scripting vulnerability in List order management item change plug-in for EC-CUBE 3.0 series Ver.1.1 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors...
Cross site scripting
Cross-site scripting vulnerability in List order management item change plug-in for EC-CUBE 3.0 series Ver.1.1 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors...
Cross site scripting
Cross-site scripting vulnerability in Order Status Batch Change Plug-in for EC-CUBE 3.0 series all versions allows a remote attacker to inject an arbitrary script via unspecified vectors...
CVE-2021-20828
Cross-site scripting vulnerability in Order Status Batch Change Plug-in for EC-CUBE 3.0 series all versions allows a remote attacker to inject an arbitrary script via unspecified vectors...
CVE-2021-20825
Cross-site scripting vulnerability in List order management item change plug-in for EC-CUBE 3.0 series Ver.1.1 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors...
CVE-2021-20828
Cross-site scripting vulnerability in Order Status Batch Change Plug-in for EC-CUBE 3.0 series all versions allows a remote attacker to inject an arbitrary script via unspecified vectors...
CVE-2021-20828
The CVE-2021-20828 entry concerns the EC-CUBE 3.0 series plugin “Order Status Batch Change Plug-in” by ActiveFusions. The vulnerability is a cross-site scripting (CWE-79) flaw caused by insufficient validation of client-side data, allowing a remote attacker to inject arbitrary script via unspecif...
CVE-2021-20825
CVE-2021-20825 affects the EC-CUBE List (order management) item change plug-in for the 3.0 series, specifically Ver.1.1 and earlier. The vulnerability is a cross-site scripting (CWE-79) flaw in the plugin, enabling an arbitrary script to be executed in the administrator’s browser via unspecified ...
CVE-2021-20825
Cross-site scripting vulnerability in List order management item change plug-in for EC-CUBE 3.0 series Ver.1.1 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors...
CVE-2021-20828: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability in Order Status Batch Change Plug-in for EC-CUBE 3.0 series all versions allows a remote attacker to inject an arbitrary script via unspecified vectors...
CVE-2021-20825: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability in List order management item change plug-in for EC-CUBE 3.0 series Ver.1.1 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors...
PT-2021-14273
Name of the Vulnerable Software and Affected Versions: Order Status Batch Change Plug-in for EC-CUBE 3.0 series all versions Description: The issue allows a remote attacker to inject an arbitrary script via unspecified vectors, which is a cross-site scripting vulnerability. Recommendations: For...
PT-2021-14270
Name of the Vulnerable Software and Affected Versions: List item change plug-in for EC-CUBE 3.0 series versions 1.1 and earlier Description: The issue allows a remote attacker to inject an arbitrary script via unspecified vectors, which can lead to cross-site scripting. Recommendations: For...
EC-CUBE plugin "Order Status Batch Change Plug-in" vulnerable to cross-site scripting
Overview EC-CUBE plugin "Order Status Batch Change Plug-in" provided by ActiveFusions Co., Ltd. contains a cross-site scripting vulnerability CWE-79. An arbitrary script may be executed by conducting a specific operation on the management page of EC-CUBE. ActiveFusions Co., Ltd. reported this...
Ec-cube 跨站脚本漏洞
Ec-cube is an open source e-commerce system from the Japanese company Ec-cube. EC-CUBE suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerability to execute client-side code...
JVN#23406150: EC-CUBE plugin "Order Status Batch Change Plug-in" vulnerable to cross-site scripting
EC-CUBE plugin "Order Status Batch Change Plug-in" provided by ActiveFusions Co., Ltd. contains a cross-site scripting vulnerability CWE-79. An arbitrary script may be executed by conducting a specific operation on the management page of EC-CUBE. Impact If a remote attacker injects a specially...
JVN#46313661: EC-CUBE plugin "List (order management) item change plug-in" vulnerable to cross-site scripting
EC-CUBE plugin "List order management item change plug-in" provided by shiro8 Co., Ltd. contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of the user who is accessing the administrative page of the product. Solution Update the plug...
EC-CUBE fails to restrict access permissions
Overview EC-CUBE provided by EC-CUBE CO.,LTD. fails to restrict access permissions CWE-284 . EC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership...