CVE-2021-24403

The Orders functionality in the WordPress Page Contact plugin through 1.0 has an orderid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors...

CVE-2021-24402

The Orders functionality in the WP iCommerce WordPress plugin through 1.1.1 has an orderid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors...

PT-2021-15935

Name of the Vulnerable Software and Affected Versions WP iCommerce WordPress plugin versions 1.1.1 and earlier Description The Orders functionality in the WP iCommerce WordPress plugin has an order id parameter that is not sanitized, escaped, or validated before being inserted into a SQL statemen...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on PHP and MySQL servers. A SQL injection vulnerability exists in WordPress Page Contact plugin 1.0 and earlier versions, which ste...

PT-2021-15936

Name of the Vulnerable Software and Affected Versions WordPress Page Contact plugin versions prior to 1.1 Description The Orders functionality in the WordPress Page Contact plugin has an issue where the order id parameter is not properly sanitized, escaped, or validated before being inserted into...

PT-2021-3490

Name of the Vulnerable Software and Affected Versions Sylius versions prior to 1.9.5 and 1.10.0-RC.1 Description The issue is related to the exposure of certain order details, including order ID, order number, items total, and token value, to unauthorized users. This information, while not...

Welcart e-Commerce < 2.2.4 - Cross-Site Scripting (XSS)

The plugin did not sanitise or validate the orderid parameter before outputting in the page of the admin dashboard, leading to a reflected Cross-Site Scripting issue PoC http://wp.lab/wordpress/wp-admin/admin.php?page=uscesorderlistaction=editid=1"...

CVE-2021-24285

The requestlistrequest AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitise, validate or escape the orderid POST parameter before using it in a SQL statement, leading to a SQL Injection...

PT-2021-15824

Name of the Vulnerable Software and Affected Versions Car Seller - Auto Classifieds Script WordPress plugin versions 2.1.0 and earlier Description The issue arises from the request list request AJAX call in the Car Seller - Auto Classifieds Script WordPress plugin, which is accessible to both...

PT-2020-17101 · WordPress · Woocommerce

Name of the Vulnerable Software and Affected Versions: WooCommerce plugin versions prior to 4.7.0 Description: The issue allows remote attackers to view the status of arbitrary orders via the order id parameter in a fetch order status action. This could potentially expose sensitive information...

PT-2017-6269

Name of the Vulnerable Software and Affected Versions Best Gallery Albums Plugin versions prior to 3.0.70 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the order id parameter in the "gallery album sorting" page to...

SQL Injection Vulnerability in Hanchao B2B2C Multi-User Mall System

Hanchao B2B2C multi-user mall system is a PHP multi-user mall website system source code developed in PHP + MySQL. Hanchao B2B2C Multi-User Mall System v2.1.3 version of the Orderid parameter, delorder method SQL injection vulnerability exists due to the system fails to effectively filter the...

Vulnerability in orderid parameter of China Telecom's handheld business hall app mall order page.

China Telecom Pocket Business Office is a cell phone terminal-based application software that provides users with recharge and payment, cost inquiries and other services. There is a vulnerability in the orderid parameter of the order page of the China Telecom Palm Business Hall app, which allows ...

LiteCart CMS 'order_id' Parameter Cross-Site Scripting Vulnerability

LiteCart CMS is a free PHP-based e-commerce content management system CMS. A cross-site scripting vulnerability exists in LiteCart CMS version 1.3.4. An attacker can exploit the vulnerability to execute arbitrary script code, steal cookie-based authentication and launch other attacks...

CVE-2016-2212

The getOrderByStatusUrlKey function in the MageRssHelperOrder class in app/code/core/Mage/Rss/Helper/Order.php in Magento Enterprise Edition before 1.14.2.3 and Magento Community Edition before 1.9.2.3 allows remote attackers to obtain sensitive order information via the orderid in a JSON object ...