103 matches found
CVE-2015-5468: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in the WP e-Commerce Shop Styling plugin before 2.6 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter to includes/download.php...
PT-2017-6861
Name of the Vulnerable Software and Affected Versions WP e-Commerce Shop Styling plugin versions prior to 2.6 Description A directory traversal issue exists, allowing remote attackers to read arbitrary files. This is achieved by using a .. dot dot in the filename parameter to the...
WP e-Commerce Shop Styling <= 2.5 - Local File Inclusion
The code in ./wp-ecommerce-shop-styling/includes/download.php does not sanitise user input to prevent sensitive system files from being downloaded. You'll have to rename the download file via mv -- -..-..-..-..-..-..-..-..-etc-passwd passwd as the filename is set to the download filename with pat...
Payment Gateways Caller for WP e-Commerce 0.1.0 - load_merchant Parameter Traversal Local file Inclusion
The Payment Gateways Caller for WP e-Commerce WordPress plugin was affected by a loadmerchant Parameter Traversal Local file Inclusion security vulnerability...
CVE-2013-5916
Cross-site scripting XSS vulnerability in falha.php in the Bradesco Gateway plugin 2.0 for Wordpress, as used in the WP e-Commerce plugin, allows remote attackers to inject arbitrary web script or HTML via the QUERYSTRING...
CVE-2013-5916: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in falha.php in the Bradesco Gateway plugin 2.0 for Wordpress, as used in the WP e-Commerce plugin, allows remote attackers to inject arbitrary web script or HTML via the QUERYSTRING...
Wordpress WP-e-Commerce plugin v3.8.9.5 Cross Site Scripting Vulnerability
Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...
[DC-2012-11-001] DefenseCode ThunderScan PHP Advisory: Wordpress WP e-Commerce Plugin Multiple Security Vulnerabilities
DefenseCode ThunderScan PHP Advisory: Wordpress WP E-Commerce Plugin Multiple Security Vulnerabilities Advisory ID: DC-2012-11-001 Advisory Title: Wordpress WP E-Commerce Plugin Multiple Vulnerabilities Advisory URL:...
CVE-2012-5310
SQL injection vulnerability in the WP e-Commerce plugin before 3.8.7.6 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors...
Sql injection
SQL injection vulnerability in the WP e-Commerce plugin before 3.8.7.6 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors...
CVE-2012-5310
The CVE-2012-5310 entry concerns the WP e-Commerce WordPress plugin, specifically versions before 3.8.7.6. Multiple sources confirm an SQL Injection vulnerability in this plugin, allowing remote attackers to execute arbitrary SQL commands via unspecified vectors. Affected component is the WP e-Co...
CVE-2012-5310
SQL injection vulnerability in the WP e-Commerce plugin before 3.8.7.6 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors...
PT-2012-5909
Name of the Vulnerable Software and Affected Versions WP e-Commerce plugin versions prior to 3.8.7.6 Description The issue allows remote attackers to execute arbitrary SQL commands. Recommendations For versions prior to 3.8.7.6, update to version 3.8.7.6 or later to resolve the issue...
CVE-2012-5310: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the WP e-Commerce plugin before 3.8.7.6 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors...
Cross site scripting
Cross-site scripting XSS vulnerability in wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the customtext parameter. NOTE: some of these details are obtained from third party...
CVE-2011-5104
Cross-site scripting XSS vulnerability in wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the customtext parameter. NOTE: some of these details are obtained from third party...
CVE-2011-5104
CVE-2011-5104 affects the WP e-Commerce plugin (WordPress) in the file wpsc-admin/display-sales-logs.php with a vulnerability in the custom_text parameter, allowing remote attackers to inject arbitrary script/HTML (XSS). The issue is observed in WP e-Commerce 3.8.7.1 and possibly earlier. Remedia...
CVE-2011-5104: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the customtext parameter. NOTE: some of these details are obtained from third party...
PT-2012-2082
Name of the Vulnerable Software and Affected Versions WP e-Commerce plugin version 3.8.7.1 and possibly earlier Description The issue is related to a cross-site scripting XSS problem. It allows remote attackers to inject arbitrary web script or HTML via the custom text parameter in the...
WordPress WP e-Commerce插件"cs1"参数SQL注入漏洞
BUGTRAQ ID: 49612 WordPress WP e-Commerce是基于WP和Web 2.0技术开发的一款电子商务购物车插件程序。 WordPress WP e-Commerce插件在"cs1"参数过滤用户数据时存在SQL注入漏洞，远程攻击者可利用此漏洞控制应用程序，访问或修改数据。 WordPress WP e-Commerce 3.8.6 厂商补丁： WordPress --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://wordpress.org/...