CVE-2020-27975

osCommerce Phoenix CE before 1.0.5.4 allows admin/definelanguage.php CSRF...

CVE-2020-27976

osCommerce Phoenix CE prior to 1.0.5.4 is affected by a remote OS command injection via admin/mail.php where a from POST parameter can reach the PHP mail function and the sendmail -f option. Root cause is command injection in processing the from parameter, enabling remote code execution per the C...

CVE-2020-27976

osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...

CVE-2020-27976: Improper Neutralization of Special Elements used in an OS Command

osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...

CVE-2020-27975: Cross-Site Request Forgery (CSRF)

osCommerce Phoenix CE before 1.0.5.4 allows admin/definelanguage.php CSRF...

PT-2020-16882

Name of the Vulnerable Software and Affected Versions osCommerce Phoenix CE versions prior to 1.0.5.4 Description The issue allows for a CSRF attack in the admin/define language.php file. Recommendations For versions prior to 1.0.5.4, update to version 1.0.5.4 or later to resolve the issue...

PT-2020-16883

Name of the Vulnerable Software and Affected Versions osCommerce Phoenix CE versions prior to 1.0.5.4 Description The issue allows for OS command injection remotely. It is caused by a vulnerable from POST parameter in the admin/mail.php file, which affects the PHP mail function and the sendmail -...

osCommerce cross-site scripting vulnerability (CNVD-2020-67836)

osCommerce is an open source online shopping e-commerce solution based on the GNUGPL license. A cross-site scripting vulnerability exists in osCommerce CE Phoenix versions prior to 1.0.6.0, which stems from a lack of proper validation of client-side data by the WEB application. An attacker can...

CVE-2020-12058

Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/orderstatus.php, catalog/admin/taxrates.php, catalog/admin/languages.php,...

CVE-2020-12058

Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/orderstatus.php, catalog/admin/taxrates.php, catalog/admin/languages.php,...

Cross site scripting

Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/orderstatus.php, catalog/admin/taxrates.php, catalog/admin/languages.php,...

CVE-2020-12058

Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/orderstatus.php, catalog/admin/taxrates.php, catalog/admin/languages.php,...

CVE-2020-12058

Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/orderstatus.php, catalog/admin/taxrates.php, catalog/admin/languages.php,...

CVE-2020-12058

CVE-2020-12058 affects osCommerce CE Phoenix prior to 1.0.6.0, where multiple XSS flaws allow injection/execution of arbitrary JavaScript. Vulnerable components include admin scripts such as order_status.php, tax_rates.php, languages.php, countries.php, tax_classes.php, reviews.php, zones.php, an...

CVE-2020-12058: Improper Neutralization of Input During Web Page Generation

Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/orderstatus.php, catalog/admin/taxrates.php, catalog/admin/languages.php,...

PT-2020-13020

Name of the Vulnerable Software and Affected Versions osCommerce CE Phoenix versions prior to 1.0.6.0 Description The issue allows an attacker to inject and execute arbitrary JavaScript code. This can be achieved by injecting malicious code into specific parameters, including the page parameter t...

NekoBot - Auto Exploiter With 500+ Exploit 2000+ Shell

NekoBotV1 | Auto Exploiter With 500+ Exploit 2000+ Shell Features : + Wordpress : 1- Cherry-Plugin 2- download-manager Plugin 3- wysija-newsletters 4- Slider Revolution Revslider 5- gravity-forms 6- userpro 7- wp-gdpr-compliance 8- wp-graphql 9- formcraft 10- Headway 11- Pagelines Plugin 12-...

CVE-2018-18573

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated administrators can upload new '.htaccess' files e.g., omitting .php and subsequently achieve arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=newprodu...

CVE-2018-18573

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated administrators can upload new '.htaccess' files e.g., omitting .php and subsequently achieve arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=newprodu...

CVE-2018-18572

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter, script files with certain PHP-related extensions such as .phtml and .php5 didn't execute in the application. But this filter didn't prevent the '.pht' extension. Thus, remote...