PT-2019-10127

Name of the Vulnerable Software and Affected Versions: PHP Scripts Mall Website Seller Script version 2.0.5 Description: The issue allows for full Path Disclosure via a request for an arbitrary image URL, such as a .png file. Recommendations: For version 2.0.5, update to a newer version that...

CVE-2018-20631: Improper Limitation of a Pathname to a Restricted Directory

PHP Scripts Mall Website Seller Script 2.0.5 allows full Path Disclosure via a request for an arbitrary image URL such as a .png file...

Design/Logic Flaw

PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896...

CVE-2018-20530: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896...

PT-2018-15415

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Website Seller Script version 2.0.5 Description The issue is related to a Cross-Site Scripting XSS vulnerability. It can be triggered via a Profile field, such as the Company Address. Recommendations For PHP Scripts Mall Websi...

CVE-2018-16456: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a keyword. NOTE: This may overlap with CVE-2018-6870 which has XSS via the Listings Search feature...

PT-2018-13276

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Website Seller Script version 2.0.5 Description The issue is related to a problem where an attacker can execute a cross-site scripting XSS attack via the Personal Address or Company Name fields. Recommendations For version...

CVE-2018-15897: Improper Restriction of Operations within the Bounds of a Memory Buffer

PHP Scripts Mall Website Seller Script 2.0.5 allows remote attackers to cause a denial of service via crafted JavaScript code in the First Name, Last Name, Company Name, or Fax field, as demonstrated by crossPwn...

PT-2018-13277

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Website Seller Script version 2.0.5 Description The issue allows remote attackers to cause a denial of service via crafted JavaScript code in the First Name, Last Name, Company Name, or Fax field. Recommendations For PHP Scrip...

CVE-2018-15896: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Website Seller Script 2.0.5 has XSS via Personal Address or Company Name...

CVE-2018-11501: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Website Seller Script 2.0.3 has CSRF via usersubmit.php?upd=2, with resultant XSS...

PT-2018-10618

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Website Seller Script version 2.0.3 Description The issue allows for CSRF via the user submit.php endpoint with the upd parameter set to 2, resulting in XSS. Recommendations For version 2.0.3, as a temporary workaround, consid...

CVE-2018-6879: Improper Input Validation

PHP Scripts Mall Website Seller Script 2.0.3 uses the client side to enforce validation of an e-mail address, which allows remote attackers to modify a registered e-mail address by removing the validation code...

CVE-2018-6870: Improper Neutralization of Input During Web Page Generation

Reflected XSS exists in PHP Scripts Mall Website Seller Script 2.0.3 via the Listings Search feature...

PT-2018-17793

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Website Seller Script version 2.0.3 Description A reflected XSS issue exists in the Listings Search feature, allowing for potential exploitation. Recommendations For version 2.0.3, update the Listings Search feature to properl...

PT-2018-17799

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Website Seller Script version 2.0.3 Description The issue allows remote attackers to modify a registered e-mail address by removing the validation code, as the validation of an e-mail address is enforced on the client side...