87 matches found
CVE-2025-4602
eMagicOne Store Manager for WooCommerce = 1.2.5 - 인증되지 않은 임의 파일 읽기 eMagicOne Store Manager for WooCommerce 플러그인은 원격 관리 프로토콜 엔드포인트?connector=bridge를 노출하여 서버에서 파일 삭제 작업을 허용합니다. 인증 메커니즘은 기본 자격 증명 쌍login=1, password=1과 세션 키 시스템에 의존합니다. 기본 자격 증명이 변경되지 않은 경우 공격자는 쉽게 인증을 받고 세션 키를 획득하여 WordPress 루트 또는 접근...
CVE-2025-4603
eMagicOne Store Manager for WooCommerce md5 EMOSMCDEFAULTLOGIN . EMOSMCDEFAULTPASSWORD , 결과: 기본 해시는 md5'1' . '1' = c4ca4238a0b923820dcc509a6f75849b입니다. 세션 키 획득 세션 키는 해시와 작업예: getversion을 포함한 POST 요청을 브리지 엔드포인트로 보내 얻습니다: POST /?connector=bridge Content-Type: application/x-www-form-urlencoded...
CVE-2025-5058
eMagicOne Store Manager for WooCommerce Warning: Trying to access array offset on false in /home/vagrant/research/Lab1/wp-content/plugins/store-manager-connector/classes/class-emosmcwoocommerceoverrider.php on line 324 Warning: Trying to access array offset on false in...
WordPress MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin <= 5.0.18 - Authenticated (Store Manager+) SQL Injection vulnerability
Authenticated Store Manager+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin MultiVendorX versions = 5.0.18...
CVE-2025-4336
eMagicOne Store Manager for WooCommerce 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlft forever 2:...
WordPress Shopping Cart & eCommerce Store plugin <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action vulnerability
Authenticated Store Manager+ Privilege Escalation to ecajaxsavepagedefaultoptions AJAX Action vulnerability discovered by Wordfence PRISM in WordPress Plugin WP EasyCart versions = 5.9.3...
EUVD-2026-74600
The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ecajaxsavepagedefaultoptions AJAX handler iterating over every $POST key and passing it directly into updateoption without any allowlist, while gating the handler...
CVE-2026-17553 Shopping Cart & eCommerce Store <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action
The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ecajaxsavepagedefaultoptions AJAX handler iterating over every $POST key and passing it directly into updateoption without any allowlist, while gating the handler...
CVE-2026-17553
The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to and including 5.9.3 . The ec_ajax_save_page_default_options() AJAX handler iterates over every $_POST key and passes it directly into update_option() without an allowlist. Access is gated on the manage_op...
PT-2026-88789
The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec ajax save page default options AJAX handler iterating over every $ POST key and passing it directly into update option without any allowlist, while gating the...
CVE-2026-42773
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection. This issue affects eMagicOne Store Manager: from n/a through 1.3.2...
CVE-2026-42773
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection. This issue affects eMagicOne Store Manager: from n/a through 1.3.2...
CVE-2026-42773
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection. This issue affects eMagicOne Store Manager: from n/a through 1.3.2...
EUVD-2026-31749
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection. This issue affects eMagicOne Store Manager: from n/a through 1.3.2...
CVE-2026-42773
CVE-2026-42773 concerns the WordPress plugin eMagicOne Store Manager (versions up to 1.3.2). The connected documents identify a vulnerability of type SQL Injection (specifically a blind SQL injection) in this plugin. Affected component is the Store Manager code path handling SQL commands, with th...
CVE-2026-42773 WordPress eMagicOne Store Manager plugin <= 1.3.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection. This issue affects eMagicOne Store Manager: from n/a through 1.3.2...
CVE-2026-42773 WordPress eMagicOne Store Manager plugin <= 1.3.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection. This issue affects eMagicOne Store Manager: from n/a through 1.3.2...
CVE-2026-42773: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection. This issue affects eMagicOne Store Manager: from n/a through 1.3.2...
WordPress plugin eMagicOne Store Manager SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A SQL injection...