952 matches found
CVE-2020-29070
osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters...
Design/Logic Flaw
osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters...
CVE-2020-29070
CVE-2020-29070 affects osCommerce 2.3.4.1. The vulnerability is a cross-site scripting (XSS) issue exploitable when an authenticated user enters an XSS payload into the title field of newsletters. No explicit exploit details or fixes are provided in the connected documents. The available sources ...
CVE-2020-29070
osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters...
CVE-2020-29070
osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters...
PT-2020-17089
Name of the Vulnerable Software and Affected Versions osCommerce version 2.3.4.1 Description The issue allows an authenticated user to enter an XSS payload into the title section of newsletters, potentially leading to a cross-site scripting vulnerability. Recommendations For osCommerce version...
osCommerce 跨站脚本漏洞
OsCommerce is an e-commerce and online store management software program. A cross-site scripting vulnerability exists in osCommerce 2.3.4.1. An attacker can exploit this vulnerability via the header section of a newsletter to conduct a cross-site scripting attack...
CVE-2020-29070: Improper Neutralization of Input During Web Page Generation
osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters...
osCommerce 2.3.4.1 - 'title' Persistent Cross-Site Scripting
Exploit Title: osCommerce 2.3.4.1 - 'title' Persistent Cross-Site Scripting Date: 2020-11-19 Exploit Author: Emre Aslan Vendor Homepage: https://www.oscommerce.com/ Version: 2.3.4.1 Tested on: Windows & XAMPP == Tutorial https://HOST/catalog/admin/newsletters.php?action=new 3- Enter the XSS paylo...
osCommerce 2.3.4.1 Cross Site Scripting
Exploit Title: osCommerce 2.3.4.1 - 'title' Persistent Cross-Site Scripting Date: 2020-11-19 Exploit Author: Emre Aslan Vendor Homepage: https://www.oscommerce.com/ Version: 2.3.4.1 Tested on: Windows & XAMPP == Tutorial https://HOST/catalog/admin/newsletters.php?action=new 3- Enter the XSS paylo...
Exploit for OS Command Injection in Oscommerce
PoC exploit for CVE-2020-27976, an authenticated remote code exe...
osCommerce CE Phoenix OS Command Injection Vulnerability
OsCommerce is an e-commerce and online store management software program.CE Phoenix is the official community version of osCommerce. An OS command injection vulnerability exists in osCommerce CE Phoenix versions prior to 1.0.5.4. An attacker can exploit this vulnerability to execute arbitrary cod...
osCommerce Phoenix CE Cross-Site Request Forgery Vulnerability
OsCommerce is an e-commerce and online store management software program.CE Phoenix is the official community version of osCommerce. A cross-site request forgery vulnerability exists in admin/definelanguage.php in osCommerce CE Phoenix versions prior to 1.0.5.4. No details of the vulnerability ar...
CVE-2020-27976
osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...
CVE-2020-27976
osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...
CVE-2020-27975
osCommerce Phoenix CE before 1.0.5.4 allows admin/definelanguage.php CSRF...
CVE-2020-27975
osCommerce Phoenix CE before 1.0.5.4 allows admin/definelanguage.php CSRF...
Command injection
osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...
Cross site request forgery (csrf)
osCommerce Phoenix CE before 1.0.5.4 allows admin/definelanguage.php CSRF...
CVE-2020-27975
CVE-2020-27975 affects osCommerce Phoenix CE prior to 1.0.5.4, with a Cross-Site Request Forgery in admin/define_language.php. The vulnerability is documented across multiple feeds (NVD entry and Red Hat/CNVD mirrors) as CSRF, indicating that unauthenticated or unintended requests could affect la...