73 matches found
CVE-2015-3301
The CartPress/TheCartPress WordPress plugin (vulnerable before 1.3.9.3) suffers a Local PHP File Inclusion/Directory Traversal (CVE-2015-3301) via the tcp_box_path parameter in checkout_editor_settings (/wp-admin/admin.php?page=checkout_editor_settings). Exploitation requires administrative privi...
CVE-2015-3300
CVE-2015-3300 covers multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress WordPress plugin (before 1.3.9.3). The affected components include checkout and admin pages, with exploitation possible through numerous input fields (billing/shipping address fields) and admin parameter ...
WordPress TheCartPress Plugin 1.3.9 /checkout/CheckoutEditor.class.php 本地文件包含漏洞
checkout/CheckoutEditor.class.phpfunction adminaction if empty $POST return; if isset $REQUEST'tcpsavefields' $partialpath = $REQUEST'tcpboxpath'; $classname = $REQUEST'tcpboxname'; $initialpath = dirname dirname TCPADMINFOLDER . '/'; requireonce $initialpath . $partialpath ; $box = new $classnam...
Multiple Vulnerabilities in TheCartPress WordPress plugin
Advisory ID: HTB23254 Product: TheCartPress WordPress plugin Vendor: TheCartPress team Vulnerable Versions: 1.3.9 and probably prior Tested Version: 1.3.9 Advisory Publication: April 8, 2015 without technical details Vendor Notification: April 8, 2015 Public Disclosure: April 29, 2015 Vulnerabili...
WordPress Plugin TheCartPress 1.3.9 - Multiple Vulnerabilities
WordPress Plugin TheCartPress 1.3.9 - Multiple Vulnerabilities Advisory ID: HTB23254 Product: TheCartPress WordPress plugin Vendor: TheCartPress team Vulnerable Versions: 1.3.9 and probably prior Tested Version: 1.3.9 Advisory Publication: April 8, 2015 without technical details Vendor...
WordPress TheCartPress Plugin 1.3.9 - Multiple Vulnerabilities
TheCartPress plugin is prone to multiple vulnerabilities, such as local PHP file inclusion, stored XSS, improper access control and multiple XSS vulnerabilities. Solution Update the plugin...
WordPress Plugin TheCartPress Has Multiple Cross-Site Scripting Vulnerabilities
WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. Multiple cross-site scripting vulnerabilities exist in the WordPress plugin TheCartPress. 1 Because many user-supplied HTTP...
WordPress TheCartPress Plugin 1.3.9 - Multiple Vulnerabilities
Exploit for php platform in category web applications Product: TheCartPress WordPress plugin Vendor: TheCartPress team Vulnerable Versions: 1.3.9 and probably prior Tested Version: 1.3.9 Advisory Publication: April 8, 2015 without technical details Vendor Notification: April 8, 2015 Public...
TheCartPress <= 1.3.9 - Multiple Vulnerabilities
The TheCartPress eCommerce Shopping Cart WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability...
WordPress Plugin TheCartPress 1.3.9 - Multiple Vulnerabilities
Advisory ID: HTB23254 Product: TheCartPress WordPress plugin Vendor: TheCartPress team Vulnerable Versions: 1.3.9 and probably prior Tested Version: 1.3.9 Advisory Publication: April 8, 2015 without technical details Vendor Notification: April 8, 2015 Public Disclosure: April 29, 2015 Vulnerabili...
WordPress TheCartPress 1.3.9 XSS / Local File Inclusion
Advisory ID: HTB23254 Product: TheCartPress WordPress plugin Vendor: TheCartPress team Vulnerable Versions: 1.3.9 and probably prior Tested Version: 1.3.9 Advisory Publication: April 8, 2015 without technical details Vendor Notification: April 8, 2015 Public Disclosure: April 29, 2015 Vulnerabili...
WordPress Plugin TheCartPress Local PHP File Inclusion Vulnerability
WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A local PHP file inclusion vulnerability exists in the WordPress plugin TheCartPress. Due to input passed to the...
WordPress Plugin TheCartPress Incorrect Access Control Vulnerability
WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. An incorrect access control vulnerability exists in the WordPress plugin TheCartPress. An unauthenticated remote attacker...
Multiple Vulnerabilities in TheCartPress WordPress plugin
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in TheCartPress WordPress plugin, which can be exploited to execute arbitrary PHP code, disclose sensitive data, and perform Cross-Site Scripting attacks against users of WordPress installations with the vulnerable plugin....
TheCartPress 1.1.1 - Remote File Inclusion
The TheCartPress eCommerce Shopping Cart WordPress plugin was affected by a Remote File Inclusion security vulnerability...
Wordpress TheCartPress Plugin 1.1.1 - Remote File Inclusion
No description provided by source. Exploit Title: Thecartpress Wordpress plugin RFI Google Dork: inurl:wp-content/plugins/thecartpress Date: 09/19/2011 Author: Ben Schmidt supernothing AT spareclockcycles.org @supernothing Software Link: http://wordpress.org/extend/plugins/thecartpress/download/...
CVE-2011-5207
Cross-site scripting XSS vulnerability in admin/OptionsPostsList.php in the TheCartPress plugin for WordPress before 1.1.6 before 2011-12-31 allows remote attackers to inject arbitrary web script or HTML via the tcpnamepostXXXXX parameter...
CVE-2011-5207
Cross-site scripting XSS vulnerability in admin/OptionsPostsList.php in the TheCartPress plugin for WordPress before 1.1.6 before 2011-12-31 allows remote attackers to inject arbitrary web script or HTML via the tcpnamepostXXXXX parameter...
CVE-2011-5207
The CVE-2011-5207 entry concerns TheCartPress WordPress plugin. Affected component: admin/OptionsPostsList.php. Vulnerability: cross-site scripting (XSS) allowing remote attackers to inject arbitrary script/HTML via the tcp_name_post_XXXXX parameter, prior to TheCartPress 1.1.6 (before 2011-12-31...
