CVE-2026-19996 Webkul Bagisto Backend Customer Behavior Data Endpoint customers privileges management

A vulnerability was identified in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/customers of the component Backend Customer Behavior Data Endpoint. Such manipulation of the argument ID leads to improper privilege management. The attack can be executed...

EUVD-2026-60062

A vulnerability was identified in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/customers of the component Backend Customer Behavior Data Endpoint. Such manipulation of the argument ID leads to improper privilege management. The attack can be executed...

CVE-2026-19996

A vulnerability was identified in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/customers of the component Backend Customer Behavior Data Endpoint. Such manipulation of the argument ID leads to improper privilege management. The attack can be executed...

CVE-2026-19836

CVE-2026-19836 affects Webkul Bagisto (up to version 2.4.4). The vulnerability lies in the Backend Customer Detail Feature, specifically the /admin/customers/view endpoint, where manipulating the ID parameter can bypass authorization. The issue can be exploited remotely and an exploit has been re...

CVE-2026-2506

The EM Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to the plugin storing attacker-controlled 'customername' data and rendering it in the admin customer list without output escaping. This makes it possible f...

PT-2025-1724

Name of the Vulnerable Software and Affected Versions Pimcore customer-data-framework versions 4.2.0 and earlier Description A critical issue has been found in Pimcore customer-data-framework, affecting some unknown functionality of the file "/admin/customermanagementframework/customers/list". Th...

CVE-2021-46448

H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/customers.php?page=1&cID...

H.H.G. Multistore SQL注入漏洞

H.H.G. Multistore is a software designed to manage multiple stores from the German company H.H.G. Multistore. A security vulnerability exists in H.H.G. Multistore v5.1.0 and below that allows an attacker to perform SQL injection via /admin/customers.php?page=1&cID...

CVE-2021-33561: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via customername in various forms of store administration. It is saved in the database. The code is executed for any user of store administration when informati...

PT-2011-5166 · Xt:Commerce · Xt:Commerce

Name of the Vulnerable Software and Affected Versions: xt:Commerce versions 3.0.4 SP2.1 and earlier Description: The issue allows remote attackers to hijack the authentication of admins for specific requests. This can be achieved through cross-site request forgery CSRF vulnerabilities. The...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in VaM Shop 1.6, 1.6.1, and probably earlier versions llow remote attackers to inject arbitrary web script or HTML via the 1 status parameter to admin/orders.php, 2 search parameter to admin/customers.php, or 3 STORENAME parameter to...

CVE-2006-6534

Multiple cross-site scripting XSS vulnerabilities in osCommerce 3.0a3 allow remote attackers to inject arbitrary web script or HTML via the 1 set parameter to admin/modules.php, the 2 selectedbox parameter to definitiva/admin/customers.php, the 3 lID parameter to admin/languagesdefinitions.php, o...