Apache 2.4.50 RCE

Remote Code Execution in Apache Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

Cross-Site Request Forgery (CSRF) in opensourcepos/opensourcepos

Description Hello, there is another CSRF vulnerability on your nice application on the following endpoint. /sales/deleteitem/saleid...

Pharmacy Point Of Sale System 1.0 SQL Injection

Exploit Title: Pharmacy Point of Sale System 1.0 - 'Multiple' SQL Injection SQLi Date: 28.09.2021 Exploit Author: Murat Vendor Homepage: https://www.sourcecodester.com/php/14957/pharmacy-point-sale-system-using-php-and-sqlite-free-source-code.html Software Link:...

Pharmacy Point of Sale System 1.0 - 'Multiple' SQL Injection (SQLi)

Exploit Title: Pharmacy Point of Sale System 1.0 - 'Multiple' SQL Injection SQLi Date: 28.09.2021 Exploit Author: Murat Vendor Homepage: https://www.sourcecodester.com/php/14957/pharmacy-point-sale-system-using-php-and-sqlite-free-source-code.html Software Link:...

Sourcecodester Sales Management System Arbitrary File Upload (CVE-2021-36623)

An arbitrary file upload vulnerability exists in Sourcecodester Sales Management System. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

CVE-2021-34636

The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin is vulnerable to Cross-Site Request Forgery via the savetheme function found in the /includes/admin/coundownthemepage.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in versions up t...

CVE-2021-34636 Countdown and CountUp, WooCommerce Sales Timer <= 1.5.7 Cross-Site Request Forgery to Stored Cross-Site Scripting

The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin is vulnerable to Cross-Site Request Forgery via the savetheme function found in the /includes/admin/coundownthemepage.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in versions up t...

CVE-2021-34636

The CVE-2021-34636 entry concerns the Countdown and CountUp, WooCommerce Sales Timers WordPress plugin. A missing nonce check in the save_theme function (~/includes/admin/coundown_theme_page.php) enables CSRF, allowing injection of arbitrary scripts (stored XSS) in versions up to 1.5.7. Connected...

Prestashop ph_simpleblog SQL Injection

SQL Injection vulnerabilty in Prestashop phsimpleblog sbcategory parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

Prestashop SmartBlog SQL Injection

SQL Injection vulnerabilty in Prestashop SmartBlog day parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

Affiliate Power < 2.3.0 - Reflected Cross-Site Scripting

The plugin does not escape the page parameter in its Affiliate Power Sales dashboard before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue PoC...

estatesales.org Cross Site Scripting vulnerability OBB-2129887

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Cybercriminals Selling Access to Compromised Networks: 3 Surprising Research Findings

Cybercriminals are innovative, always finding ways to adapt to new circumstances and opportunities. The proof of this can be seen in the rise of a certain variety of activity on the dark web: the sale of access to compromised networks. This type of dark web activity has existed for decades, but i...

Oracle E-Business Suite Sales Offline Denial of Service (CVE-2021-2189)

An infinite loop vulnerability exists in the Sales Offline component of Oracle E-Business Suite. The vulnerability is due to improper handling of requests by the authentication component of Sales Offline...

WordPress Total Sales For Woocommerce plugin <= 1.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by iohex and WPScanTeam in WordPress Total Sales For Woocommerce plugin versions = 1.1. Solution 2021-08-27 - no patched version available...

Cross-Site Request Forgery (CSRF) in tsolucio/corebos

✍️ Description Attacker able to delete any Sales Order with CSRF attack because there is any CSRF protection for related endpoint. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know...

CVE-2021-36805

Akaunting version 2.1.12 and earlier suffers from a persistent type II cross-site scripting XSS vulnerability in the sales invoice processing component of the application. This issue was fixed in version 2.1.13 of the product...

CVE-2021-36800

Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application. A POST sent to /companyid/sales/invoices/invoiceid with an items0price that includes a PHP callable function is executed directly. This issue was fixed in version 2.1.13 of the...

Cross site scripting

Akaunting version 2.1.12 and earlier suffers from a persistent type II cross-site scripting XSS vulnerability in the sales invoice processing component of the application. This issue was fixed in version 2.1.13 of the product...

Code injection

Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application. A POST sent to /companyid/sales/invoices/invoiceid with an items0price that includes a PHP callable function is executed directly. This issue was fixed in version 2.1.13 of the...