CVE-2023-38330

OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administration area. An attacker can upload a file with a modified header to create a HTTP Response Splitting attack...

CVE-2023-38330: Unrestricted Upload of File with Dangerous Type

OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administration area. An attacker can upload a file with a modified header to create a HTTP Response Splitting attack...

Cross site request forgery (csrf)

OXID eShop Community Edition before 6.0.0 RC2 development, 4.10.x before 4.10.5 maintenance, and 4.9.x before 4.9.10 legacy, Enterprise Edition before 6.0.0 RC2 development, 5.2.x before 5.2.10 legacy, and 5.3.x before 5.3.5 maintenance, and Professional Edition before 6.0.0 RC2 development, 4.9....

CVE-2018-5763: Improper Input Validation

An issue was discovered in OXID eShop Enterprise Edition before 5.3.7 and 6.x before 6.0.1. By entering specially crafted URLs, an attacker is able to bring the shop server to a standstill and hence, it stops working. This is only valid if OXID High Performance Option is activated and Varnish is...

CVE-2014-2016: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in OXID eShop Professional and Community Edition 4.6.8 and earlier, 4.7.x before 4.7.11, and 4.8.x before 4.8.4, and Enterprise Edition 4.6.8 and earlier, 5.0.x before 5.0.11 and 5.1.x before 5.1.4 allow remote attackers to inject arbitrary web...

OXID eShop Enterprise Edition Cross Site Scripting / Session Fixation

--------------------------------------------- OXID eShop Enterprise Edition - Session Fixation Vulnerability - Stored Cross Site Scripting Vulnerability Date: 30.03.2010 --------------------------------------------- - Description OXID eShop EE is a widespread and popular CMS for online shops. The...

CVE-2009-3113: Undefined Security Weakness

Unspecified vulnerability in OXID eShop Professional, Enterprise, and Community Edition before 4.1.2, 3.x, and 2.x allows remote attackers to gain write access to product reviews via a crafted parameter...

CVE-2009-3112: Undefined Security Weakness

Unspecified vulnerability in OXID eShop Professional, Enterprise, and Community Edition before 4.1.0 allows remote attackers to gain administrator privileges and access the shop backend via a crafted parameter...