Mail.ru: idor leads to leak order information

IDOR in zakazaka.ru API allowed to list items of order content without attribution to user...

Lianya Networks B2C website building system has a logic flaw vulnerability

Guangzhou Lianya Network Technology Co., Ltd. a technology-based network company. Lianya Networks B2C website builder system has a logic flaw vulnerability that can be exploited by an attacker to view other people's order information...

Hedgehog website builder system has a logic flaw vulnerability

Hedgehog website is a new responsive intelligent website building products. Using a standardized website building system, it creates a new generation of website building products for the majority of small and medium-sized enterprises. Hedgehog system has a logic flaw vulnerability, attackers can...

CVE-2019-18608

Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests. Hence, a malicious customer can manipulate an order e.g., its payment status or shipping fee by adding additional...

Unauthorized Access Vulnerability in Pharmaceutical E-Commerce Retail System

Pharmaceutical e-commerce retail system is a retail system with a complete prescription drug purchase process developed by Guangzhou LeShang Software Technology Co. An unauthorized access vulnerability exists in the pharmaceutical e-commerce retail system, which can be exploited by an attacker to...

Magento Community Edition 2.0.x < 2.0.16 Multiple Vulnerabilities

Binary data 700416.prm...

BOHEMIA INTERACTIVE a.s.: IDOR to view User Order Information

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Description: There is a...

Cross site scripting

Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the...

PHPSHE open source mall system order.php page exists out of rights access vulnerability

PHPSHE mall system is a combination of product display, online shopping, order management, payment management, article management, customer consultation feedback and other functions, providing users with online shopping mall construction program. PHPSHE open source mall system order.php page ther...

ASP4CMS AspCMS Information Disclosure Vulnerability

ASP4CMS AspCMS is China's ASP4CMS open source laboratory of a free enterprise website construction system . The system supports customized templates and plug-in extensions and other features. ASP4CMS AspCMS 2.7.2 version of the member/Orderinfo.asp file has a security vulnerability. A remote...

CVE-2017-14653

member/Orderinfo.asp in ASP4CMS AspCMS 2.7.2 allows remote authenticated users to read arbitrary order information via a modified OrderNo parameter...

Information disclosure

member/Orderinfo.asp in ASP4CMS AspCMS 2.7.2 allows remote authenticated users to read arbitrary order information via a modified OrderNo parameter...

WordPress Email Test Plugin <= 1.5 - Order Information Disclosure

This plugin is prone to an order information disclosure vulnerability. Solution Update the plugin...

WordPress Email Test Plugin <= 1.5 - Order Information Disclosure

This plugin is prone to an order information disclosure vulnerability. Solution Update the plugin...

Magento Community Edition < 1.9.2.3 Multiple Vulnerabilities

Binary data 9679.prm...

WordPress Plugin Order Export Import for WooCommerce - Order Information Disclosure

WordPress Plugin Order Export Import for WooCommerce - Order Information Disclosure Exploit Title: WordPress Plugin Order Export Import for WooCommerce Link: https://wordpress.org/plugins/order-import-export-for-woocommerce/ Version: 1.0.8 Date: 19th 2016 Exploit Author: contact a david-peltier d...

CVE-2016-2212

The getOrderByStatusUrlKey function in the MageRssHelperOrder class in app/code/core/Mage/Rss/Helper/Order.php in Magento Enterprise Edition before 1.14.2.3 and Magento Community Edition before 1.9.2.3 allows remote attackers to obtain sensitive order information via the orderid in a JSON object ...

金蝶shop商城后台弱口令泄露大量商家/会员信息/订单/网站信息

简要描述： 之前报的洞走了大厂商竟然就给了1rank，桑心啊，深夜挖洞挺不容易的，求给良心rank。。。 详细说明： 直接上图证明吧，出现问题的域名。 http://k3shop.k3cloud.kingdee.com/ 大致的扫了下网站目录，找到后台可直接登录admin用户！ 泄露的网站信息 http://k3shop.k3cloud.kingdee.com/sitemap.xml 漏洞证明： 订单信息 商家信息 会员信息...

Many well-known hotel chains, high-end brand hotels there are serious security vulnerabilities, massive open room information stored in the disclosure risk-vulnerability warning-the black bar safety net

Well-known Inn orange, Jinjiang Inn, the super eight, pudding; high-end hotel the MARRIOTT Hotel Group, MARRIOTT, Ritz Carlton, Starwood group, Sheraton, Le Meridien, W Hotels, Intercontinental Hotel Group, Holiday Inn, etc there is a serious security breach, the tenant Open House information at ...

逐浪cms多处绕过验证导致的安全问题。

简要描述： RT 详细说明： 哎，通过DEMO的测试站点来枚举一下吧 http://demo.zoomla.cn/Admin/I/Shop/Orderlistinfo.aspx?id=9 http://demo.zoomla.cn/Admin/I/Content/ShowContent.aspx?GID=43&modeid=19 http://demo.zoomla.cn/Admin/Template/LabelManage.aspx http://demo.zoomla.cn/Admin/Content/NodeManage.aspx...