CVE-2026-84437

A cross-site scripting (XSS) vulnerability affects OpenCart 4.1.0.3 and 4.1.0.4 , specifically in the Autocomplete Workflow component within the file catalog/controller/account/address.php. Manipulating the address_1 argument allows a remote, authenticated (low-privilege) attacker to inject scrip...

CVE-2026-84437 OpenCart Autocomplete Workflow address.php cross site scripting

A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address1 results in cross site scripting. It is possible to launch the...

CVE-2026-84437 OpenCart Autocomplete Workflow address.php cross site scripting

A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address1 results in cross site scripting. It is possible to launch the...

PT-2026-84585

Name of the Vulnerable Software and Affected Versions OpenCart versions 4.1.0.3 through 4.1.0.4 Description An issue exists in the Autocomplete Workflow component within the file catalog/controller/account/address.php. Remote manipulation of the address 1 argument allows for cross site scripting,...

CVE-2026-75498

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'boquery' parameter in the 'Address.php' file. Fixed in 123c97c...

CVE-2026-75498 Webkul QloApps SQL injection

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'boquery' parameter in the 'Address.php' file. Fixed in 123c97c...

CVE-2026-75498 Webkul QloApps SQL injection

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'boquery' parameter in the 'Address.php' file. Fixed in 123c97c...

CVE-2026-75498

Webkul QloApps is susceptible to SQL injection due to missing validation of request parameters before a database query. A remote attacker with administrative privileges can inject a crafted SQL query via the bo_query parameter in the Address.php file. The flaw allows high impact on confidentialit...

EUVD-2026-65588

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'boquery' parameter in the 'Address.php' file. Fixed in 123c97c...

PT-2026-81426

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo query' parameter in the 'Address.php' file. Fixed in 123c97c...

CVE-2026-75498: Improper Neutralization of Special Elements used in an SQL Command

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'boquery' parameter in the 'Address.php' file. Fixed in 123c97c...

CVE-2024-28560

SQL injection vulnerability in Niushop B2B2C v.5.3.3 and before allows an attacker to escalate privileges via the deleteArea function of the Address.php component...

CVE-2024-28560: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Niushop B2B2C v.5.3.3 and before allows an attacker to escalate privileges via the deleteArea function of the Address.php component...

CVE-2024-28560

Niushop B2B2C versions 5.3.3 and earlier are susceptible to a SQL injection vulnerability. This flaw exists in the deleteArea() function of the Address.php component, allowing an attacker to escalate privileges . Additionally, the setPrice() function in the Goodsbatchset.php component is also aff...

CVE-2024-28560

SQL injection vulnerability in Niushop B2B2C v.5.3.3 and before allows an attacker to escalate privileges via the deleteArea function of the Address.php component...

Niushop B2B2C 安全漏洞

Niushop niushop b2b2c is a PHP open source e-commerce multi-merchant system from China Niukoo Information Technology Niushop. A security vulnerability exists in Niushop B2B2C v.5.3.3 and earlier versions. An attacker exploited the vulnerability to extract power via the deleteArea function of the...

CVE-2018-19137

DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter...

CVE-2018-19137

DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter...

CVE-2018-19137: Improper Neutralization of Input During Web Page Generation

DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter...

PT-2018-14828

Name of the Vulnerable Software and Affected Versions DomainMOD versions prior to 4.11.02 Description The issue allows for XSS via the ipid parameter in the "assets/edit/ip-address.php" endpoint. Recommendations For DomainMOD versions prior to 4.11.02, update to version 4.11.02 or later to resolv...