CVE-2023-48926

An issue in 202 ecommerce Advanced Loyalty Program: Loyalty Points before v2.3.4 for PrestaShop allows unauthenticated attackers to arbitrarily change an order status...

CVE-2023-2179

The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making...

CVE-2023-1987

A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. Affected by this vulnerability is the function updateorderstatus of the file /classes/Master.php?f=updateorderstatus. The manipulation of the argument id leads to sql injection. The...

CVE-2023-3202

The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstoreupdatefirebaseserverkey function. This makes it possible for unauthenticated attackers to update the firebase server key to push notification when order status changed via ...

CVE-2021-24846

The getquery function of the Ni WooCommerce Custom Order Status WordPress plugin before 1.9.7, used by the niwoocosajax AJAX action, available to all authenticated users, does not properly sanitise the sort parameter before using it in a SQL statement, leading to an SQL injection, exploitable by...

CVE-2020-29156

The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the orderid parameter in a fetchorderstatus action...

DRUPAL-CONTRIB-2025-066

This module enables you to pay for Commerce order to an environment provided and secured by the bank The module doesn't sufficiently verify the payment status on canceled orders. An attacker can issue a specially crafted request to update the order status to completed...

Commerce Alphabank Redirect - Moderately critical - Access bypass - SA-CONTRIB-2025-067

This module enables you to pay for Commerce order to an environment provided and secured by the bank The module doesn't sufficiently verify the payment status on canceled orders. An attacker can issue a specially crafted request to update the order status to completed...

CVE-2025-30781

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in WPFactory Scheduled & Automatic Order Status Controller for WooCommerce order-status-rules-for-woocommerce allows Phishing.This issue affects Scheduled & Automatic Order Status Controller for WooCommerce: from n/a through = 3.7.1...

WordPress Scheduled & Automatic Order Status Controller for WooCommerce plugin <= 3.7.1 - Open Redirection Vulnerability

Open Redirection Vulnerability discovered by Le Ngoc Anh in WordPress Plugin Scheduled & Automatic Order Status Controller for WooCommerce versions = 3.7.1...

WordPress plugin Scheduled & Automatic Order Status Controller for WooCommerce 输入验证错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation error...

PT-2025-13065

Name of the Vulnerable Software and Affected Versions Scheduled & Automatic Order Status Controller for WooCommerce versions 3.7.1 and earlier Description The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability, which allows phishing. This...

CVE-2025-30781: URL Redirection to Untrusted Site

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in WPFactory Scheduled & Automatic Order Status Controller for WooCommerce order-status-rules-for-woocommerce allows Phishing.This issue affects Scheduled & Automatic Order Status Controller for WooCommerce: from n/a through = 3.7.1...

TastyIgniter 安全漏洞

TastyIgniter is an online ordering software from TastyIgniter open source. A security vulnerability exists in TastyIgniter version 3.7.6, which stems from improper access control of the indexonUpdateStatus function in the Orders Management System, which could result in an unauthorized user updati...

PT-2025-11609

Name of the Vulnerable Software and Affected Versions TastyIgniter version 3.7.6 Description The issue is related to an Incorrect Access Control flaw in the Orders Management System, allowing unauthorized users to update order statuses. This occurs due to a failure in verifying user permissions...

CVE-2020-26223

Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Ord...

CVE-2024-12712

CVE-2024-12712 affects the Shopping Cart & eCommerce Store (WordPress) plugin, citing a missing capability check on the webhook function that allowed unauthenticated modification of order statuses in all versions up to 5.7.8. Public sources from Red Hat and Wordfence indicate this was patched in ...

PT-2024-17854 · Beijing Longda Jushang Technology · Dbshop市场系统

Name of the Vulnerable Software and Affected Versions: Beijing Longda Jushang Technology DBShop商城系统 version 3.3 Release 231225 Description: A cross-site scripting issue affects the /home-order file, where manipulating the orderStatus argument with a specific input leads to cross-site scripting. T...

Code-Projects Simple Admin Panel 注入漏洞

Code-Projects Simple Admin Panel is a simple admin panel for Code-Projects open source. An injection vulnerability exists in Code-Projects Simple Admin Panel version 1.0, which stems from an SQL injection vulnerability in the record parameter of the updateOrderStatus.php file...

PT-2024-17808 · Unknown · Code-Projects Simple Admin Panel

Name of the Vulnerable Software and Affected Versions: code-projects Simple Admin Panel version 1.0 Description: A critical vulnerability has been found in the file updateOrderStatus.php, affecting an unknown functionality. The manipulation of the record argument leads to SQL injection. The attac...