WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting

WordPress eCommerce Product Catalog plugin before 3.0.39 contains a cross-site scripting vulnerability. The plugin does not escape the ic-settings-search parameter before outputting it back in the page in an attribute. This can allow an attacker to steal cookie-based authentication credentials an...

SMTP WP Plugin Directory Listing

The WordPress Easy WP SMTP Plugin has its log folder remotely accessible and its content available for access. id: CVE-2020-35234 info: name: SMTP WP Plugin Directory Listing author: PR3R00T severity: high description: The WordPress Easy WP SMTP Plugin has its log folder remotely accessible and i...

SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting

A vulnerability was found in SPA-Cart eCommerce CMS 1.9.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /search. The manipulation of the argument filterbrandid/filterprice leads to cross site scripting. The attack may be launched remotely...

CVE-2025-26865

CVE-2025-26865: Apache OfBiz の「ecommerce」プラグインを介した FreeMarker サーバーサイドテンプレートインジェクション 18.12.17 と 18.12.18 の間で発生したリグレッションにより、CVE-2022-25813: FreeMarker Server-Side Template Injection in Apache OfBiz の発見に基づく修正が適用されなくなり、「ecommerce」プラグインを利用した FreeMarker サーバーサイドテンプレートインジェクション SSTI 攻撃の可能性が再び開かれました。...

CVE-2021-27190-PEEL-Shopping-cart-9.3.0-Stored-XSS

CVE-2021-27190 - PEEL Shopping、eコマースショッピングカート - 'Address' における格納型クロスサイトスクリプティング脆弱性 日付 2021-02-11 脆弱性発見者 Anmol K Sachan ベンダーホームページ https://www.peel.fr/ ソフトウェアリンク https://www.peel.fr/nos-offres-1/peel-shopping-31.html https://sourceforge.net/projects/peel-shopping/ 脆弱性のあるソフトウェアリンク...

CVE-2026-7393-RCE

Pizzafy Ecommerce System 1.0 – savemenu の無制限ファイルアップロードによるリモートコード実行 詳細 フィールド| 値 ---|--- ベンダー| SourceCodester ベンダー URL| https://www.sourcecodester.com 製品| Pizzafy Ecommerce System using PHP and MySQL 製品 URL| https://www.sourcecodester.com/php/18708/pizzafy-ecommerce-system.html バージョン| 1.0 脆弱性|...

CVE-2026-7394-SQLI

Pizzafy Ecommerce System における SQL インジェクション — admin/vieworder.php 詳細 フィールド| 値 ---|--- ベンダー| SourceCodester 製品| PHPとMySQLを使用したPizzafy Ecommerce System バージョン| 1.0 脆弱性| SQLインジェクション CWE| CWE-89 CVSSv3スコア| 7.2 高 攻撃ベクトル| ネットワーク 認証要件| あり（管理者） 研究者| Xmyronn 日付| 2026-04-11...

CVE-2026-96344

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

EUVD-2026-89857

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

CVE-2026-96344 WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

CVE-2026-96344 WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

CVE-2026-96344

The eCommerce Product Catalog plugin for WordPress (versions

CVE-2021-39476

CVE-2021-39476 PhoenixCart 1.0.8.0 に複数のXSS脆弱性を発見 同一ページに2x XSS "SEOのためのカテゴリタイトルの編集:" "カテゴリ説明の編集" リンク: https://www.warcloudsecurity.com/ecommerce/index.php?cPath=1...

CVE-2026-91154

Missing Authentication for Critical Function CWE-306 in the product cache revalidation Server Action src/app/actions.ts, revalidateProducts in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated attacker to force expiration of the entire storefront product cac...

CVE-2026-91154 Missing authentication in Ecommerce Template product cache revalidation allows unauthenticated denial of service

Missing Authentication for Critical Function CWE-306 in the product cache revalidation Server Action src/app/actions.ts, revalidateProducts in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated attacker to force expiration of the entire storefront product cac...

CVE-2026-91154 Missing authentication in Ecommerce Template product cache revalidation allows unauthenticated denial of service

Missing Authentication for Critical Function CWE-306 in the product cache revalidation Server Action src/app/actions.ts, revalidateProducts in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated attacker to force expiration of the entire storefront product cac...

EUVD-2026-88333

Missing Authentication for Critical Function CWE-306 in the product cache revalidation Server Action src/app/actions.ts, revalidateProducts in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated attacker to force expiration of the entire storefront product cac...

CVE-2026-91154

The MarcosCamara01 Ecommerce Template (before commit ec97209 ) is vulnerable to a Missing Authentication for Critical Function (CWE-306) within the revalidateProducts Server Action located in src/app/actions.ts. Because the file uses a "use server" scope without session or role checks, the revali...

CVE-2026-91154 Missing authentication in Ecommerce Template product cache revalidation allows unauthenticated denial of service

Missing Authentication for Critical Function CWE-306 in the product cache revalidation Server Action src/app/actions.ts, revalidateProducts in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated attacker to force expiration of the entire storefront product cac...

CVE-2026-2631

CVE-2026-2631 Datalogics Ecommerce Delivery – Datalogics PoC / エクスプロイトスクリプト: CVE-2026-2631.py 著者: Khaled Alenazi Nxploited – Nxploited ZeroDay Hub 連絡先: Telegram: @Kxploit 🧬 脆弱性の概要 プラグイン: Datalogics Ecommerce Delivery – Datalogics WordPress 影響を受けるバージョン: 2.6.60（2.6.60 未満） 脆弱性タイプ: 未認証の権限昇格 CVE:...