SMS Alert Order Notifications – WooCommerce < 3.7.0 - Cross-Site Request Forgery

Description The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.9. This is due to missing or incorrect nonce validation on the processBulkAction function. This makes it possible for...

Zammad 安全漏洞

Zammad is a suite of ticket management software from the German company Zammad. a security vulnerability exists in Zammad, which stems from the ability of agents to configure out of office periods and substitutes. If substitutes do not have the same privileges as the original agent, they may...

CVE-2021-24588

The SMS Alert Order Notifications WordPress plugin before 3.4.7 is affected by a cross site scripting XSS vulnerability in the plugin's setting page...

CVE-2021-24588 SMS Alert Order Notifications – WooCommerce < 3.4.7 Authenticated Cross Site Scripting

The SMS Alert Order Notifications WordPress plugin before 3.4.7 is affected by a cross site scripting XSS vulnerability in the plugin's setting page...

CVE-2021-24588

The WordPress plugin SMS Alert Order Notifications – WooCommerce (versions before 3.4.7) is affected by an authenticated cross-site scripting (XSS) vulnerability in the settings page. CVE-2021-24588 documents an XSS with a CVSS v3.1 base score of 6.1. Remediation: upgrade to version 3.4.7 or late...

WordPress 插件跨站脚本漏洞

WordPress is a set of blogging platforms developed by the WordPress Wordpress Foundation using the PHP language. A cross-site scripting vulnerability exists in the WordPress plugin, which stems from a cross-site scripting XSS vulnerability in the settings page of the SMS Alert Order Notifications...

Shopify: Order notifications being sent for a deactivated staff account

Hi, Steps to reproduce : - - Have a staff account with settings permission - The staff account can go to notifications & add himself so as to get new order notifications - Now,deactivate the staff account via the admin. - Create a new order,you shall see that the staff still receives the order...

Shopify: An administrator without any permission is able to get order notifications using his APNS Token.

Description ---- An administrator who lacks the 'Settings' permission is not able to add notifications through the UI. But the endpoint shop.myshopify.com/admin/mobiledevices.json does allow the unprivileged user to add his own device. PoC ---- This PoC simply show how to get & re-use the mobile...