Subrion CMS 跨站脚本漏洞

Subrion CMS is a PHP-based content management system CMS from the Subrion team. The system can be integrated into a website and supports a variety of extensions plugins and more. A cross-site scripting vulnerability exists in Subrion CMS 4.2.1 and earlier versions. The vulnerability can be...

CVE-2021-28110

/exec in TranzWare e-Commerce Payment Gateway TWEC PG before 3.1.27.5 had a vulnerability in its XML parser...

CVE-2021-28110

/exec in TranzWare e-Commerce Payment Gateway TWEC PG before 3.1.27.5 had a vulnerability in its XML parser...

Code injection

/exec in TranzWare e-Commerce Payment Gateway TWEC PG before 3.1.27.5 had a vulnerability in its XML parser...

CVE-2021-28126

The CVE-2021-28126 entry concerns TranzWare e-Commerce Payment Gateway (TWEC PG) prior to version 3.1.27.5, where index.jsp contains a stored XSS vulnerability. This is documented across multiple connected records (Red Hat, NVD, CVE lists, and regional advisories) and is specific to the TWEC PG’s...

CVE-2021-28110

CVE-2021-28110 affects TranzWare e-Commerce Payment Gateway (TWEC PG) prior to version 3.1.27.5, due to a vulnerability in its XML parser. The issue is described without exploitation details in the provided sources, with CVSSv3.1 base score 7.5 (Network attack, no privileges required, high availa...

CVE-2021-28110

/exec in TranzWare e-Commerce Payment Gateway TWEC PG before 3.1.27.5 had a vulnerability in its XML parser...

Compass Plus e-Commerce Payment Gateway 代码问题漏洞

Compass Plus e-Commerce Payment Gateway is an application interface of the Russian company Compass Plus. It provides an API interface for payment functions. A security vulnerability exists in TranzWare e-Commerce Payment Gateway before 3.1.27.5, which is caused by a vulnerability in the XML parse...

Extra Charges To Payment Gateway For WooCommerce <= 2.0.2.1 - Unauthorised Arbitrary Plugin Settings Change to Stored XSS

The addformfields method, hooked to the adminhead action is lacking any CSRF and capability checks, allowing low privilege users to arbitrary update those settings, and set XSS payloads in them as well, which could lead to privilege escalation. Unauthenticated users could also make a logged in us...

Extra Charges To Payment Gateway For WooCommerce <= 2.0.2.1 - Unauthorised Arbitrary Plugin Settings Change to Stored XSS

The addformfields method, hooked to the adminhead action is lacking any CSRF and capability checks, allowing low privilege users to arbitrary update those settings, and set XSS payloads in them as well, which could lead to privilege escalation. Unauthenticated users could also make a logged in us...

Doneren met Mollie < 2.8.5 - Unauthorised CSV Export leading to Sensitive Data Disclosure

The plugin did not check for user capability in the dmmexportdonations function, allowing any authenticated user to export a CSV file containing all donors personal information. GET /wp-admin/admin-post.php?action=dmmexport...

Compassplus TranzWare Payment Gateway Cross-Site Scripting Vulnerability

Compassplus TranzWare Payment Gateway is a software from Compassplus UK that can provide payment services. A security vulnerability exists in Compassplus TranzWare Payment Gateway version 3.1.12.3.2, which can be exploited by an attacker to execute arbitrary HTML code via a crafted url...

CVE-2020-28415

A reflected cross-site scripting XSS vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url different vector than CVE-2020-28414...

CVE-2020-28414

A reflected cross-site scripting XSS vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url different vector than CVE-2020-28415...

Cross site scripting

A reflected cross-site scripting XSS vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url different vector than CVE-2020-28414...

Cross site scripting

A reflected cross-site scripting XSS vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url different vector than CVE-2020-28415...

CVE-2020-28414

A reflected cross-site scripting XSS vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url different vector than CVE-2020-28415...

CVE-2020-28414

CVE-2020-28414 describes a reflected XSS in Compassplus TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker can trigger arbitrary HTML code via a crafted URL, as per the NVD entry. Connected records also associate a related CVE-2020-28415. The root cause and exact exploit deta...

CVE-2020-28415

CVE-2020-28415 describes a reflected cross-site scripting (XSS) vulnerability in TranzWare Payment Gateway 3.1.12.3.2. Multiple connected sources (e.g., CNVD entries) indicate an attack vector where a crafted URL can cause the application to output arbitrary HTML, enabling an attacker to potentia...

CVE-2020-28415

A reflected cross-site scripting XSS vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url different vector than CVE-2020-28414...