CVE-2025-26865

CVE-2025-26865: FreeMarker Server-Side Template Injection via the "ecommerce" plugin in Apache OfBiz Due to a regression between 18.12.17 and 18.12.18 the fix for finding CVE-2022-25813: FreeMarker Server-Side Template Injection in Apache OfBiz was no longer enforced which reopened the possibilit...

WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting

WordPress eCommerce Product Catalog plugin before 3.0.39 contains a cross-site scripting vulnerability. The plugin does not escape the ic-settings-search parameter before outputting it back in the page in an attribute. This can allow an attacker to steal cookie-based authentication credentials an...

SMTP WP Plugin Directory Listing

The WordPress Easy WP SMTP Plugin has its log folder remotely accessible and its content available for access. id: CVE-2020-35234 info: name: SMTP WP Plugin Directory Listing author: PR3R00T severity: high description: The WordPress Easy WP SMTP Plugin has its log folder remotely accessible and i...

SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting

A vulnerability was found in SPA-Cart eCommerce CMS 1.9.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /search. The manipulation of the argument filterbrandid/filterprice leads to cross site scripting. The attack may be launched remotely...

CVE-2026-7394-SQLI

SQL Injection in Pizzafy Ecommerce System — admin/vieworder.php Details Field| Value ---|--- Vendor| SourceCodester Product| Pizzafy Ecommerce System using PHP and MySQL Version| 1.0 Vulnerability| SQL Injection CWE| CWE-89 CVSSv3 Score| 7.2 High Attack Vector| Network Auth Required| Yes...

CVE-2026-7393-RCE

Pizzafy Ecommerce System 1.0 – Unrestricted File Upload in savemenu Leads to Remote Code Execution Details Field| Value ---|--- Vendor| SourceCodester Vendor URL| https://www.sourcecodester.com Product| Pizzafy Ecommerce System using PHP and MySQL Product URL|...

CVE-2021-39476

CVE-2021-39476 Found multiple XSS vulnerabilities within PhoenixCart 1.0.8.0 2x XSS on the same page "Edit the Category Title for SEO:" "Edit the Category Description" Link: https://www.warcloudsecurity.com/ecommerce/index.php?cPath=1...

CVE-2026-2631

CVE-2026-2631 Datalogics Ecommerce Delivery – Datalogics PoC / Exploit Script: CVE-2026-2631.py Author: Khaled Alenazi Nxploited – Nxploited ZeroDay Hub Contact: Telegram: @Kxploit 🧬 Vulnerability Overview Plugin: Datalogics Ecommerce Delivery – Datalogics WordPress Affected Versions: 2.6.60...

CVE-2026-106015

The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators...

CVE-2026-106015

The Ecommerce Affiliate WordPress plugin versions up to and including 1.0.0 is vulnerable to an unauthenticated account takeover. The root cause is that the plugin fails to restrict one-time password (OTP) issuance and verification to the legitimate account owner and does not implement limits on ...

CVE-2026-106015 Ecommerce Affiliate <= 1.0.0 - Unauthenticated Account Takeover via Email OTP Brute Force

The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators...

EUVD-2026-119475

The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators...

PT-2026-139906

The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators...

CVE-2026-114277

Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz. Apache OFBiz's optional Janrain Engage Social Login integration in the ecommerce component improperly binds authenticated external identities to local user accounts. This issue affects Apache OFBiz: before 24.09.08...

CVE-2026-114277

Apache OFBiz is vulnerable to an authentication bypass due to an Assumed-Immutable data vulnerability (CWE-302). The issue exists in the ecommerce component 's optional Janrain Engage Social Login integration, which improperly binds authenticated external identities to local user accounts. This v...

CVE-2026-114277 Apache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local Accounts

Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz. Apache OFBiz's optional Janrain Engage Social Login integration in the ecommerce component improperly binds authenticated external identities to local user accounts. This issue affects Apache OFBiz: before 24.09.08...

EUVD-2026-117443

Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz. Apache OFBiz's optional Janrain Engage Social Login integration in the ecommerce component improperly binds authenticated external identities to local user accounts. This issue affects Apache OFBiz: before 24.09.08...

CVE-2026-114277 Apache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local Accounts

Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz. Apache OFBiz's optional Janrain Engage Social Login integration in the ecommerce component improperly binds authenticated external identities to local user accounts. This issue affects Apache OFBiz: before 24.09.08...

PT-2026-137472

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 24.09.08 Description An authentication bypass exists in the optional Janrain Engage Social Login integration within the ecommerce component. The system improperly binds authenticated external identities to local...

CVE-2026-120577

The FluentCart WordPress plugin (all versions up to and including 1.6.2 ) is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function. Authenticated attackers with custom-level access and above can exploit this to delete arbitrary files on the serv...