CVE-2022-4328

The CVE-2022-4328 entry concerns the WordPress plugin WooCommerce Checkout Field Manager (before 18.0). The vulnerability arises from failure to validate uploaded files in the cfom_upload_file action, enabling unauthenticated remote arbitrary file uploads (e.g., PHP) to the server. Impact is desc...

WordPress plugin WooCommerce Checkout Field Manager 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Social Sharing is a social sharing plugin used in it.WordPress plugin is an applicatio...

CVE-2022-4328: Undefined Security Weakness

The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server...

PT-2023-14186

Name of the Vulnerable Software and Affected Versions WooCommerce Checkout Field Manager WordPress plugin versions prior to 18.0 Description The issue allows unauthenticated attackers to upload arbitrary files, such as PHP files, to the server due to a lack of file validation for uploads. This...

CVE-2023-23865

Cross-Site Request Forgery CSRF vulnerability in Checkout Plugins Stripe Payments For WooCommerce plugin = 1.4.10 leads to settings change...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Checkout Plugins Stripe Payments For WooCommerce plugin = 1.4.10 leads to settings change...

PT-2023-19265 · WordPress · Checkout Plugins Stripe Payments For Woocommerce

Name of the Vulnerable Software and Affected Versions: Checkout Plugins Stripe Payments For WooCommerce plugin versions 1.4.10 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which can lead to changes in settings. Recommendations: For versions...

CVE-2023-23865: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Checkout Plugins Stripe Payments For WooCommerce plugin = 1.4.10 leads to settings change...

CVE-2023-0987

A vulnerability classified as problematic was found in SourceCodester Online Pizza Ordering System 1.0. This vulnerability affects unknown code of the file index.php?page=checkout. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed...

PT-2023-16668 · Sourcecodester · Sourcecodester Online Pizza Ordering System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Pizza Ordering System version 1.0 Description: A problematic issue was found in the SourceCodester Online Pizza Ordering System, affecting the file "index.php?page=checkout". This issue leads to cross-site scripting and...

CVE-2023-0987: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic was found in SourceCodester Online Pizza Ordering System 1.0. This vulnerability affects unknown code of the file index.php?page=checkout. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed...

Stored HTML Injection inside the >>> Request payment >>> Request Customer Data Checkout >>> Request shipping address

Team, I hope you are all doing well. . I wanted to bring to your attention a potential vulnerability on the website https://mainnet.demo.btcpayserver.org/stores/6YSiuoN6q1yF2ucWZvWojBuVJAJzXxFFUn9cw8iNPPMC/payment-requests/edit/ec575d56-6b8e-41bd-8b9a-bdcda9c5daad. . During my research, I...

SUSE CVE-2004-0180

The client for CVS before 1.11 allows a remote malicious CVS server to create arbitrary files using certain RCS diff files that use absolute pathnames during checkouts or updates, a different vulnerability than CVE-2004-0405...

SUSE CVE-2018-11235

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because...

WooCommerce Checkout Field Manager < 18.0 - Unauthenticated Arbitrary File Upload

The plugin does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server PoC 1. Install and activate woocommerce dependency, no setup required 2. Install and active the vulnerable plugin n-media-woocommerce-checkout-fields...

Insufficient Verification Of Data Authenticity

swag/paypal is vulnerable to Insufficient Verification Of Data Authenticity. When the JavaScript-based PayPal checkout methods PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card are used the amount and item list sent to PayPal may not be identical to the one in the created...

WordPress Woocommerce Vietnam Checkout Plugin <= 2.0.4 is vulnerable to Cross Site Scripting (XSS)

Software Woocommerce Vietnam Checkout Type Plugin Vulnerable versions = 2.0.4 Fixed in 2.0.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-46843 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a2c2374a1822 Credits Team...

CVE-2023-23941

SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card, the amount and item list sent to PayPal may not be identical to the one in the created order. The problem has bee...

GHSA-VXPM-8HCP-QH27 Payment information sent to PayPal not necessarily identical to created order

Impact If JavaScript-based PayPal checkout methods are used PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card, the amount and item list sent to PayPal may not be identical to the one in the created order. Patches The problem has been fixed with version 5.4.4 Workarounds...

CVE-2023-23941 SwagPayPal payment not sent to PayPal correctly

SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card, the amount and item list sent to PayPal may not be identical to the one in the created order. The problem has bee...