CVE-2024-40498

CVE-2024-40498 Affected Application online-shopping-system-advanced 1.0 https://github.com/PuneethReddyHC/online-shopping-system-advanced Description The file register.php handles user registration. At line 117, the POST parameters "$address1" and $address2" are unsanitized, unlike the e-mail,...

CVE-2025-51970

CVE-2025-51970 CVE-2025-51970 - SQL Injection in Online Shopping System Advanced Summary A critical SQL Injection vulnerability was discovered in the Online Shopping System Advanced project by PuneethReddyHC. The flaw resides in action.php, which fails to properly sanitize user input from the...

CVE-2026-128042

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a race condition in shopping cart price rule usage limits, because MageSalesRuleModelValidator checks coupon limits without locking and the usage counters are later incremented non-atomically. Unauthenticated...

CVE-2026-128042 OpenMage magento-lts before 20.19.0 Race Condition in Coupon Usage Limits

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a race condition in shopping cart price rule usage limits, because MageSalesRuleModelValidator checks coupon limits without locking and the usage counters are later incremented non-atomically. Unauthenticated...

EUVD-2026-125066

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a race condition in shopping cart price rule usage limits, because MageSalesRuleModelValidator checks coupon limits without locking and the usage counters are later incremented non-atomically. Unauthenticated...

CVE-2025-10046

CVE-2025-10046 - ELEX WooCommerce Google Shopping Author: Byte Reaper Description CVE-2025-10046 is a SQL injection vulnerability in the ELEX WooCommerce Google Shopping Product Feed plugin for WordPress, versions 1.4.3 and earlier. The issue resides in the includes/elex-manage-feed-ajax.php file...

PuneethReddyHC Online Shopping System homeaction.php SQL Injection

An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping System through the /homeaction.php catid parameter. Using a post request does not sanitize the user input. id: CVE-2021-41649 info: name: PuneethReddyHC Online Shopping System homeaction.php SQL Injection...

PuneethReddyHC action.php SQL Injection

An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping through the /action.php prId parameter. Using a post request does not sanitize the user input. id: CVE-2021-41648 info: name: PuneethReddyHC action.php SQL Injection author: daffainfo severity: high descriptio...

CVE-2025-52021

CVE-2025-52021 — Time-Based Blind SQL Injection in PuneethReddyHC / Online Shopping System Advanced v1.0 CVE: CVE-2025-52021 Title: Time-Based Blind SQL Injection via productid parameter in editproduct.php Vendor / Repo: PuneethReddyHC —...

CVE-2025-51820

CVE-2025-51820 A critical Remote Code Execution RCE vulnerability CVE-2025-51820 has been discovered in the Shopping Portal v1.0. 🚨 Remote Code Execution in Online Shopping Portal Project v1.0 CVE-2025-51820 🔍 Introduction In today’s digital world, Remote Code Execution RCE remains one of the mos...

DWrwq

Descrip PHPGurukul Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting XSS in /admin/updateorder.php. Vulnerability Overview 1.Vulnerability Type: Stored Cross-Site Scripting XSS 2.Affected Product: Online Shopping Portal Project - 2.1 3.Affected Component:...

CVE-2025-61246

CVE-2025-61246 - SQL Injection Vulnerability in Online Shopping System Overview This repository contains a Proof of Concept PoC for CVE-2025-61246 , a critical SQL Injection vulnerability discovered in the Online Shopping System PHP application. The vulnerability allows an unauthenticated attacke...

CVE-2024-50970

CVE-2024-50970 Description A SQL injection vulnerability in orderview1.php of Itsourcecode Online Furniture Shopping Project 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. Vulnerability Type SQL Injection Vendor of Product Itsourcecode Affected Product Code...

CVE-2024-8949-POC

Broken Access Control Vulnerability was discoverd in Sourcecodester Online Eyewear Shopping Website ID,Cart ID Manipulation Leads to Unwanted Item Addition and Deletion into User's Cart CVE-2024-8949 Vendor: Sourcecodester...

CVE-2021-41649

CVE-2021-41649 CVE-2021-41649 SQL Injection in online-shopping-system The online-shopping-system is vulnerable to un-authenticated error/boolean-based blind & error based SQL Injection attacks. The catid parameter on the /homeaction.php page does not sanitize the user input, an attacker can extra...

CVE-2024-39090-PoC

CVE-2024-39090 PoC Exploit Script This PoC script exploits CVE-2024-39090, a CSRF to Stored XSS vulnerability in PHPGurukul Online Shopping Portal v2.0. It automates CSRF attacks to inject persistent JavaScript payloads, which execute when a privileged user accesses the affected page, enabling...

CVE-2023-38890

CVE-2023-38890 Description Online Shopping Portal Project V3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in t...

CVE-2024-50968

CVE-2024-50968 Description A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1.0, which allows remote attackers to manipulate the quant parameter when adding a product to the cart. By setting the quantity value to -0, an attacker...

CVE-2021-41648

CVE-2021-41648 CVE-2021-41648 SQL Injection in online-shopping-system The online-shopping-system is vulnerable to un-authenticated error/boolean-based blind & error based SQL Injection attacks. The proId parameter on the /action.php page does not sanitize the user input, an attacker can extract...

CVE-2026-114271

Authorization Bypass Through User-Controlled Key in the shopping list services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated low-privileged user, such as a self-registered ecommerce customer, to modify another party's shopping list or take ownership of it, and...