Merchandise Online Store SQL注入漏洞

Merchandise Online Store is a merchandise online store system. merchandise Online Store has a security vulnerability that can be exploited by attackers via /vloggersmerch/admin/orders/vieworder.php?view=user&id = SQL injection attack...

Bookly < 20.3.1 - Staff Member Stored Cross-Site Scripting

The plugin does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue As a Staff Member, put the following payload in your Full Name Booklyn -- Profile -- Edit -- Full Name: alert/XSS/ The XSS will be triggered when an...

Bookly < 20.3.1 - Staff Member Stored Cross-Site Scripting

The plugin does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue PoC As a Staff Member, put the following payload in your Full Name Booklyn -- Profile -- Edit -- Full Name: The XSS will be triggered when an admin ope...

Paid Membership Pro < 2.5.10 - Cross-Site Scripting (XSS)

The plugin was affected by a. Cross-Site Scripting issue in the edit order page or the admin dashboard...

Stripo Inc: [www.stripo.email] You can override the speed limit by adding the X-Forwarded-For header.

Summary In https://stripo.email/template-order I think you have implemented rate limiting via 429 status code for too many requests, but in reality it is not. An attacker could bypass the 429 speed limit by adding an X-Forwarded-For header. Steps To Reproduce 1. Go to the...

Kernel update: Virtuozzo ReadyKernel patch 77.1 for Virtuozzo 7.0.7

The cumulative Virtuozzo ReadyKernel patch was updated with stability fixes. The patch applies to Virtuozzo kernels 3.10.0-693.17.1.vz7.43.10 Virtuozzo 7.0.7. Vulnerability id: PSBM-93349 ploop: potential data corruption due to a race between 'preparemerge' and 'submitalloc' operations...

Kernel update: Virtuozzo ReadyKernel patch 77.0 for Virtuozzo 7.0.6 and 7.0.6 HF3

The cumulative Virtuozzo ReadyKernel patch was updated with stability fixes. The patch applies to Virtuozzo kernels 3.10.0-693.1.1.vz7.37.30 Virtuozzo 7.0.6 and 3.10.0-693.11.6.vz7.40.4 Virtuozzo 7.0.6 HF3. Vulnerability id: PSBM-93349 ploop: potential data corruption due to a race between...

Automattic: DOM based XSS in the WooCommerce plugin

I have found a stored DOM based XSS in the order page at WooCommerce 3.5.6. The Data input from HTML element name shippingstate and billingstate in order page outputs data without escaping.When the victim read the page containing the payload, it executes the script. Steps to reproduce 1. From a...

SQL injection vulnerability in foods_order.class.php page of UQCMS Cloud B2B2C multi-store system

B2B2C multi-store system is a B2B2C e-commerce software with PHP+MYSQL program and smarty template. A SQL injection vulnerability exists in the goodsorder.class.php page of the UQCMS Cloud Business B2B2C Multi-Store System. The vulnerability stems from the fact that the program does not adequatel...

sabaq.pk XSS vulnerability

Vulnerable URL: http://www.sabaq.pk/card-order/order-customer.php Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 31909 VIP website status:| Yes Coordinated Disclosure Timeline: Description| Value ---|---...

PHPSHE open source mall system order.php page exists out of rights access vulnerability

PHPSHE mall system is a combination of product display, online shopping, order management, payment management, article management, customer consultation feedback and other functions, providing users with online shopping mall construction program. PHPSHE open source mall system order.php page ther...

SQL Injection Vulnerability in PHPSHE B2C Mall System order.php Parameters

PHPSHE mall system is a combination of product display, online shopping, order management, payment management, article management, customer consultation feedback and other functions, providing users with online shopping mall construction program. A SQL injection vulnerability exists in the...

latavolaristorante.com XSS vulnerability

Vulnerable URL: http://www.latavolaristorante.com/?page=/gcs/order.php"alert/OPENBUGBOUNTY/...

AbanteCart Cross-Site Scripting Vulnerability

AbanteCart is a free PHP-based e-commerce solution. A cross-site scripting vulnerability exists in the address1 parameter of the New Order page in AbanteCart version 1.2.7, which stems from the program failing to adequately filter user-submitted input. An attacker could use this vulnerability to...

balances.com XSS vulnerability

Vulnerable URL: http://www.balances.com/money-order.php?qnty1=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E1=141=4611=MSRP%3A+94.95%0D%0AOur+Price%3A+49.95%0D%0ACapacity%3A+7000g%0D%0AResolution%3A+1g%0D%0AS%26H%3A+%249.95 Details: Description| Value ---|--- Patched:| No Latest check for patch:|...

SquirrelMail: CSRF in the empty trash feature and in Index Order page

Multiple cross-site request forgery CSRF vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via vectors involving 1 the empty trash implementation and 2 the Index Order aka optionsorder page, a different issue than...

UBUNTU-CVE-2011-2753

Multiple cross-site request forgery CSRF vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via vectors involving 1 the empty trash implementation and 2 the Index Order aka optionsorder page, a different issue than...

CVE-2011-2753

Multiple cross-site request forgery CSRF vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via vectors involving 1 the empty trash implementation and 2 the Index Order aka optionsorder page, a different issue than...

CVE-2010-4555

Multiple cross-site scripting XSS vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 drop-down selection lists, 2 the greater than character in the SquirrelSpell spellchecking plugin, and 3 errors associated wit...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 drop-down selection lists, 2 the greater than character in the SquirrelSpell spellchecking plugin, and 3 errors associated wit...