CVE-2025-9835

A vulnerability has been found in macrozheng mall up to 1.0.3. This affects the function cancelOrder of the file /order/cancelUserOrder. The manipulation of the argument orderId leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed to the public and m...

CVE-2025-9836 macrozheng mall paySuccess authorization

A vulnerability was found in macrozheng mall up to 1.0.3. This vulnerability affects the function paySuccess of the file /order/paySuccess. The manipulation of the argument orderId results in authorization bypass. The attack can be launched remotely. The exploit has been made public and could be...

CVE-2025-9835 macrozheng mall cancelUserOrder cancelOrder authorization

A vulnerability has been found in macrozheng mall up to 1.0.3. This affects the function cancelOrder of the file /order/cancelUserOrder. The manipulation of the argument orderId leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed to the public and m...

PT-2025-35616

Name of the Vulnerable Software and Affected Versions: macrozheng mall versions up to 1.0.3 Description: A vulnerability exists in macrozheng mall versions up to 1.0.3. The cancelOrder function within the /order/cancelUserOrder file is affected. Manipulation of the orderId argument can lead to...

mall 安全漏洞

mall is an e-commerce system for macro individual developers, including the front-end mall system and back-end management system. A security vulnerability exists in mall 1.0.3 and earlier versions, which stems from an authorization bypass due to incorrect operation of the parameter orderId in the...

CVE-2025-7642

CVE-2025-7642 affects the WordPress plugin Simpler Checkout, with authentication bypass in versions 0.7.0–1.1.9 due to improper identity verification in the simplerwc_woocommerce_order_created() flow, allowing unauthenticated attackers to log in as other users (potential admin if a test admin ord...

CVE-2025-8755 macrozheng mall com.macro.mall.portal.controller UmsMemberController.java detail authorization

A vulnerability was found in macrozheng mall up to 1.0.3 and classified as problematic. This issue affects the function detail of the file UmsMemberController.java of the component com.macro.mall.portal.controller. The manipulation of the argument orderId leads to authorization bypass. The attack...

CVE-2025-6834

A vulnerability was found in code-projects Inventory Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /phpaction/editPayment.php. The manipulation of the argument orderId leads to sql injection. The attack can be initiated remotely. The...

CVE-2025-5002

A vulnerability, which was classified as critical, was found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file /userproposalupdateorder.php. The manipulation of the argument orderid leads to sql injection. It is possible to initiate the attack...

SourceCodester Client Database Management System 注入漏洞

SourceCodester Client Database Management System is SourceCodester open source a client database management system . SourceCodester Client Database Management System version 1.0 has an injection vulnerability, the vulnerability stems from the file /userproposalupdateorder.php improper handling of...

CVE-2025-46190

SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in userdeliveryupdate.php via the orderid POST parameter...

CVE-2025-46189

SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in userordercustomerupdate.php via the orderid POST parameter...

PT-2025-20582

Name of the Vulnerable Software and Affected Versions SourceCodester Client Database Management System version 1.0 Description The software is susceptible to a SQL Injection issue within the user payment update.php file. The issue occurs through the order id POST parameter. The vulnerability allo...

SourceCodester Client Database Management System 安全漏洞

SourceCodester Client Database Management System is a SourceCodester open source client database management system. A security vulnerability exists in SourceCodester Client Database Management System version 1.0, which originates from SQL injection due to incorrect operation of the parameter...

SourceCodester Client Database Management System 安全漏洞

SourceCodester Client Database Management System is a SourceCodester open source client database management system. A security vulnerability exists in SourceCodester Client Database Management System version 1.0, which originates from SQL injection due to incorrect operation of the parameter...

CVE-2025-3405

A vulnerability was found in FCJ Venture Builder appclientefiel 3.0.27. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /rest/cliente/ObterPedido/ of the component HTTP GET Request Handler. The manipulation of the argument ORDERID leads ...

PT-2025-15330 · Unknown · Fcj Venture Builder Appclientefiel

Name of the Vulnerable Software and Affected Versions: FCJ Venture Builder appclientefiel version 3.0.27 Description: A vulnerability was found in the FCJ Venture Builder appclientefiel, affecting an unknown functionality of the file /rest/cliente/ObterPedido/ of the component HTTP GET Request...

FCJ Venture Builder appclientefiel 安全漏洞

FCJ Venture Builder appclientefiel is an application from FCJ Venture Builder, Inc. A security vulnerability exists in FCJ Venture Builder appclientefiel version 3.0.27, which stems from an incorrect manipulation of the parameter ORDERID can lead to improper control of resource identifiers...

PT-2025-2180 · WordPress · Event Tickets/Registration

Name of the Vulnerable Software and Affected Versions: Event Tickets and Registration plugin for WordPress versions up to, and including, 5.18.1 Description: The issue allows unauthenticated attackers to view order details of orders they did not place, which includes ticket prices, user emails, a...

WordPress Traveler plugin <= 3.1.6 - Unauthenticated SQL Injection via order_id vulnerability

Unauthenticated SQL Injection via orderid vulnerability discovered by Lucio Sá in WordPress Theme Traveler versions = 3.1.6...