CVE-2024-50968

CVE-2024-50968 描述 itsourcecode Agri-Trading Online Shopping System 1.0 的“添加到购物车”功能存在业务逻辑漏洞，允许远程攻击者在向购物车添加产品时操纵 quant 参数。通过将数量值设置为 -0，攻击者可以利用应用程序总价计算逻辑中的缺陷。此漏洞导致总价降至零，使攻击者能够将商品添加到购物车并继续结账。 漏洞类型 业务逻辑漏洞 产品供应商 itsourcecode 受影响产品代码库： Agri-Trading Online Shopping System - 1.0 受影响组件： 其 sourcecode...

Information Exposure

Overview bagisto/bagisto is a hand tailored E-Commerce framework designed on some opensource technologies such as Laravel a PHP framework, Vue.js a progressive Javascript framework. Affected versions of this package are vulnerable to Information Exposure in the add-to-cart API and the downloadabl...

CVE-2026-79409

An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components...

CVE-2026-79410

Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate price of shippable goods...

CVE-2026-79410

Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate price of shippable goods...

CVE-2026-79409: Authorization Bypass Through User-Controlled Key

An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components...

CVE-2026-79410

Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate price of shippable goods...

CVE-2026-79409

An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components...

CVE-2026-79410

Webkul Bagisto v2.4.9 is vulnerable to a vulnerability where improper validation of the quantity parameter in the add-to-cart path allows authenticated attackers to manipulate order totals. By providing a negative quantity , an attacker can reduce the total order amount below the legitimate price...

EUVD-2026-79299

An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components...

CVE-2026-79409

An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components...

PT-2026-92385

An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components...

PT-2026-92386

Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate price of shippable goods...

CVE-2026-79409

An issue in Webkul Bagisto version 2.4.9 allows a remote attacker to obtain sensitive information. The vulnerability stems from an authorization bypass through a user-controlled key , specifically involving cross-product downloadable entitlement grants via unvalidated links[] parameters. This aff...

EUVD-2026-79296

Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate price of shippable goods...

CVE-2026-84045 E-cab Taxi Booking Manager for Woocommerce < 2.0.5 - Unauthenticated Price Manipulation via mptbm_add_to_cart

The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking...

CVE-2026-78137 StoreGrowth: Smart Sales Booster for WooCommerce < 2.1.2 - Unauthenticated Arbitrary Price Manipulation via BOGO Add-to-Cart

The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO...

CVE-2026-78137 StoreGrowth: Smart Sales Booster for WooCommerce < 2.1.2 - Unauthenticated Arbitrary Price Manipulation via BOGO Add-to-Cart

The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO...

CVE-2026-78137

The StoreGrowth: Smart Sales Booster for WooCommerce WordPress plugin (versions before 2.1.2 ) is vulnerable to an unauthenticated arbitrary price manipulation vulnerability. The root cause is a failure to validate browser-supplied product prices during two specific unauthenticated actions. If th...

CVE-2026-4080

The Easy Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'addtocart' shortcode in all versions up to and including 1.8. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Specifically, the ectpaddtocart function...