CVE-2018-20631: Improper Limitation of a Pathname to a Restricted Directory

PHP Scripts Mall Website Seller Script 2.0.5 allows full Path Disclosure via a request for an arbitrary image URL such as a .png file...

Design/Logic Flaw

PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896...

CVE-2018-20530: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896...

CVE-2018-16456: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a keyword. NOTE: This may overlap with CVE-2018-6870 which has XSS via the Listings Search feature...

CVE-2018-15896: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Website Seller Script 2.0.5 has XSS via Personal Address or Company Name...

CVE-2018-15897: Improper Restriction of Operations within the Bounds of a Memory Buffer

PHP Scripts Mall Website Seller Script 2.0.5 allows remote attackers to cause a denial of service via crafted JavaScript code in the First Name, Last Name, Company Name, or Fax field, as demonstrated by crossPwn...

CVE-2018-11501: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Website Seller Script 2.0.3 has CSRF via usersubmit.php?upd=2, with resultant XSS...

CVE-2018-6870: Improper Neutralization of Input During Web Page Generation

Reflected XSS exists in PHP Scripts Mall Website Seller Script 2.0.3 via the Listings Search feature...

CVE-2018-6879: Improper Input Validation

PHP Scripts Mall Website Seller Script 2.0.3 uses the client side to enforce validation of an e-mail address, which allows remote attackers to modify a registered e-mail address by removing the validation code...