evershop-stored-xss-cve

Security Vulnerability Disclosure – Stored XSS via File Upload...

WordPress Enhanced Catalog Images for WooCommerce plugin <= 1.0.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Enhanced Catalog Images for WooCommerce plugin versions = 1.0.1. Solution No patched version available...

WordPress Enhanced Catalog Images for WooCommerce plugin <= 1.0.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Enhanced Catalog Images for WooCommerce plugin versions = 1.0.1. Solution No patched version available...

osCommerce Code Execution Vulnerability

osCommerce is an open source online shopping e-commerce solution based on the GNUGPL license. A security vulnerability exists in the .htaccess file of the http://host ip/oscommerce2/catalog/images/ page in osCommerce version 2.3.4.1. The vulnerability can be exploited to execute arbitrary code or...

CVE-2018-18964: Undefined Security Weakness

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but there are several extensions in which contained HTML can be executed, such as the svg extension...

CVE-2018-18965: Undefined Security Weakness

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but there are several alternative cases in which HTML can be executed, such as a file with no extension or an unrecognized extension e.g.,...

CVE-2018-18966: Undefined Security Weakness

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but Internet Explorer render HTML elements in a .eml file...