DWrwq

Descrip PHPGurukul Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting XSS in /admin/updateorder.php. Vulnerability Overview 1.Vulnerability Type: Stored Cross-Site Scripting XSS 2.Affected Product: Online Shopping Portal Project - 2.1 3.Affected Component:...

CVE-2025-51970

CVE-2025-51970 CVE-2025-51970 - SQL Injection in Online Shopping System Advanced Summary A critical SQL Injection vulnerability was discovered in the Online Shopping System Advanced project by PuneethReddyHC. The flaw resides in action.php, which fails to properly sanitize user input from the...

CVE-2021-41649

CVE-2021-41649 CVE-2021-41649 SQL Injection in online-shopping-system The online-shopping-system is vulnerable to un-authenticated error/boolean-based blind & error based SQL Injection attacks. The catid parameter on the /homeaction.php page does not sanitize the user input, an attacker can extra...

CVE-2023-38890

CVE-2023-38890 Description Online Shopping Portal Project V3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in t...

CVE-2021-41648

CVE-2021-41648 CVE-2021-41648 SQL Injection in online-shopping-system The online-shopping-system is vulnerable to un-authenticated error/boolean-based blind & error based SQL Injection attacks. The proId parameter on the /action.php page does not sanitize the user input, an attacker can extract...

CVE-2024-39090-PoC

CVE-2024-39090 PoC Exploit Script This PoC script exploits CVE-2024-39090, a CSRF to Stored XSS vulnerability in PHPGurukul Online Shopping Portal v2.0. It automates CSRF attacks to inject persistent JavaScript payloads, which execute when a privileged user accesses the affected page, enabling...

CVE-2025-10046

CVE-2025-10046 - ELEX WooCommerce Google Shopping Author: Byte Reaper Description CVE-2025-10046 is a SQL injection vulnerability in the ELEX WooCommerce Google Shopping Product Feed plugin for WordPress, versions 1.4.3 and earlier. The issue resides in the includes/elex-manage-feed-ajax.php file...

CVE-2024-50968

CVE-2024-50968 Description A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1.0, which allows remote attackers to manipulate the quant parameter when adding a product to the cart. By setting the quantity value to -0, an attacker...

CVE-2024-40498

CVE-2024-40498 Affected Application online-shopping-system-advanced 1.0 https://github.com/PuneethReddyHC/online-shopping-system-advanced Description The file register.php handles user registration. At line 117, the POST parameters "$address1" and $address2" are unsanitized, unlike the e-mail,...

PuneethReddyHC action.php SQL Injection

An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping through the /action.php prId parameter. Using a post request does not sanitize the user input. id: CVE-2021-41648 info: name: PuneethReddyHC action.php SQL Injection author: daffainfo severity: high descriptio...

CVE-2025-61246

CVE-2025-61246 - SQL Injection Vulnerability in Online Shopping System Overview This repository contains a Proof of Concept PoC for CVE-2025-61246 , a critical SQL Injection vulnerability discovered in the Online Shopping System PHP application. The vulnerability allows an unauthenticated attacke...

PuneethReddyHC Online Shopping System homeaction.php SQL Injection

An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping System through the /homeaction.php catid parameter. Using a post request does not sanitize the user input. id: CVE-2021-41649 info: name: PuneethReddyHC Online Shopping System homeaction.php SQL Injection...

CVE-2025-52021

CVE-2025-52021 — Time-Based Blind SQL Injection in PuneethReddyHC / Online Shopping System Advanced v1.0 CVE: CVE-2025-52021 Title: Time-Based Blind SQL Injection via productid parameter in editproduct.php Vendor / Repo: PuneethReddyHC —...

WordPress Simple Shopping Cart plugin < 5.3.3 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Simple Shopping Cart versions 5.3.3...

CVE-2026-104642

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those...

CVE-2026-104641

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an...

CVE-2026-104642

The Simple Shopping Cart WordPress plugin (versions 5.1.3 - 5.3.2 ) is vulnerable to a Price Manipulation issue due to a Price Verification Bypass . The root cause is the plugin's failure to verify submitted product prices against values set exclusively by the site owner. This allows users with t...

CVE-2026-104642 Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification Bypass

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those...

EUVD-2026-107144

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those...

CVE-2026-104642 Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification Bypass

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those...