757 matches found
CVE-2025-26206: Cross-Site Request Forgery (CSRF)
Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges via the index.html component...
Citrix Infrastructure Monitoring- issue with adding new PVS/SF servers for monitoring from Cloud UI
When Admin tries to add/register new PVS or Storefront Servers for monitoring, the eror message appears:Incorrect token. Ensure you copy and paste the token correctly. The token is valid. Network trace shows 500 response code when the request is send to...
Exploit for Cross-Site Request Forgery (CSRF) in Selldone Storefront
🚨 CVE-2025-26206: Cross-Site Request Forgery CSRF in Sell Do...
Exploit for Cross-Site Request Forgery (CSRF) in Selldone Storefront
🚨 CVE-2025-26206: Cross-Site Request Forgery CSRF in Sell Do...
WordPress ClickBank Storefront WordPress Plugin plugin <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin ClickBank Storefront versions = 1.7...
CVE-2025-22385
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. For newly created accounts, the Commerce B2B application does not require email confirmation. This medium-severity issue allows the mass creation of accounts. This could affect database storage; also, non-requested...
CVE-2025-22385
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. For newly created accounts, the Commerce B2B application does not require email confirmation. This medium-severity issue allows the mass creation of accounts. This could affect database storage; also, non-requested...
CVE-2025-22386
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tied to logged-out sessions to still be active and usable...
CVE-2025-22384
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific scenarios where requests are altered before reaching...
CVE-2025-22386
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tied to logged-out sessions to still be active and usable...
PT-2025-4480 · Optimizely · Optimizely Configured Commerce
Name of the Vulnerable Software and Affected Versions: Optimizely Configured Commerce versions prior to 5.2.2408 Description: A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific...
CVE-2025-22384
A medium-severity business logic vulnerability exists in Optimizely Configured Commerce before version 5.2.2408 . The flaw resides in the Commerce B2B application , where storefront visitors can purchase discontinued products if requests are altered before reaching the server. To remediate this, ...
CVE-2025-22385
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. For newly created accounts, the Commerce B2B application does not require email confirmation. This medium-severity issue allows the mass creation of accounts. This could affect database storage; also, non-requested...
CVE-2025-22386: Insufficient Session Expiration
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tied to logged-out sessions to still be active and usable...
Application launch is stuck at the stage "Please wait for the Local Session Manager"
Application launch is stuck at the stage "Please wait for the Local Session Manager". Launch is initiated using FAS enabled storefront URL. No error message displayed to user. No credential prompt. The launch works fine when using storefront URL without FAS...
WordPress Clickbank Storefront plugin <= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability
Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin Clickbank Storefront versions = 1.7...
CVE-2024-11336: Cross-Site Request Forgery (CSRF)
The Clickbank WordPress Plugin Storefront plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing or incorrect nonce validation via the csmenu page. This makes it possible for unauthenticated attackers to update settings a...
If Workspace Apps is deployed by StoreFront, platformRateLimitPktDrop can be recorded in ns.log.
"platformRateLimitPktDrop" is recorded when the licensed bandwidth is exceeded. Recent Citrix Workspace Apps size is larger than before. If you set "Local files on the storeFront server on Citrix StoreFront", licensed bandwidth can be exceeded...
Spinning wheel during store access for German users, after Storefront upgrade from 2402 to 2402 CU1
Issue: After upgrading Storefront from 2402 to 2402 CU1, German language users may experience a spinning wheel during store access. This does not apply when upgrading from earlier versions of StoreFront, such as from 2203 to 2402 CU1. Symptoms or Error: The developer tool shows Http 404 error for...