2024 matches found
CVE-2020-27976: Improper Neutralization of Special Elements used in an OS Command
osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...
PT-2020-16882
Name of the Vulnerable Software and Affected Versions osCommerce Phoenix CE versions prior to 1.0.5.4 Description The issue allows for a CSRF attack in the admin/define language.php file. Recommendations For versions prior to 1.0.5.4, update to version 1.0.5.4 or later to resolve the issue...
phoenix-plakias.com Cross Site Scripting vulnerability OBB-1451494
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
phoenix-plakias.com Cross Site Scripting vulnerability OBB-1438388
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
phoenix-plakias.com Cross Site Scripting vulnerability OBB-1424725
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
phoenix-strategies.com Cross Site Scripting vulnerability OBB-1422927
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
phoenixcomputerrepairservice.net Cross Site Scripting vulnerability OBB-1300583
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
osCommerce cross-site scripting vulnerability (CNVD-2020-67836)
osCommerce is an open source online shopping e-commerce solution based on the GNUGPL license. A cross-site scripting vulnerability exists in osCommerce CE Phoenix versions prior to 1.0.6.0, which stems from a lack of proper validation of client-side data by the WEB application. An attacker can...
CVE-2020-12058
Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/orderstatus.php, catalog/admin/taxrates.php, catalog/admin/languages.php,...
Cross site scripting
Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/orderstatus.php, catalog/admin/taxrates.php, catalog/admin/languages.php,...
CVE-2020-12058
CVE-2020-12058 affects osCommerce CE Phoenix prior to 1.0.6.0, where multiple XSS flaws allow injection/execution of arbitrary JavaScript. Vulnerable components include admin scripts such as order_status.php, tax_rates.php, languages.php, countries.php, tax_classes.php, reviews.php, zones.php, an...
CVE-2020-12058
Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/orderstatus.php, catalog/admin/taxrates.php, catalog/admin/languages.php,...
CVE-2020-12058
Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/orderstatus.php, catalog/admin/taxrates.php, catalog/admin/languages.php,...
CVE-2020-12058: Improper Neutralization of Input During Web Page Generation
Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/orderstatus.php, catalog/admin/taxrates.php, catalog/admin/languages.php,...
PT-2020-13020
Name of the Vulnerable Software and Affected Versions osCommerce CE Phoenix versions prior to 1.0.6.0 Description The issue allows an attacker to inject and execute arbitrary JavaScript code. This can be achieved by injecting malicious code into specific parameters, including the page parameter t...
PT-2020-5503 · Mpxj · Mpxj
Name of the Vulnerable Software and Affected Versions: MPXJ versions 8.1.3 and earlier Description: The issue is related to the incorrect restriction of XML external entity references in the GanttProjectReader and PhoenixReader components of the MPXJ library. This can allow a remote attacker to...
Phoenix Contact PLCnext Engineer Path Traversal Vulnerability
Phoenix Contact PLCnext Engineer is a suite of engineering software platforms for automation controllers from Phoenix Contact, Germany. A path traversal vulnerability exists in PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier. The vulnerability stems from a failure of a networked...
CVE-2020-12499
In PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier an improper path sanitation vulnerability exists on import of project files...
Path traversal
In PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier an improper path sanitation vulnerability exists on import of project files...
CVE-2020-12499 PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier: Improper path sanitation vulnerability.
In PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier an improper path sanitation vulnerability exists on import of project files...