WordPress Checkout Plugin - Remote Code Execution

This plugin is prone to a file upload remote code execution vulnerability. Solution Upgrade version Timthumb or Delete Files timthumb.php...

Directory traversal

Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. dot dot in the tcpboxpath parameter in the checkouteditorsettings page to...

PT-2015-6372

Name of the Vulnerable Software and Affected Versions TheCartPress eCommerce Shopping Cart plugin for WordPress versions prior to 1.3.9.3 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that conduct directory...

PT-2015-6141

Name of the Vulnerable Software and Affected Versions TheCartPress eCommerce Shopping Cart plugin for WordPress versions prior to 1.3.9.3 Description The issue allows remote attackers to inject arbitrary web script or HTML via various parameters, including billing firstname, billing lastname,...

PT-2015-6142

Name of the Vulnerable Software and Affected Versions TheCartPress eCommerce Shopping Cart plugin for WordPress versions prior to 1.3.9.3 Description A directory traversal issue exists, allowing remote administrators to read arbitrary files. This is achieved by using a .. dot dot in the tcp box...

CVE-2015-3300: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allow remote attackers to inject arbitrary web script or HTML via the 1 billingfirstname, 2 billinglastname, 3...

WordPress Plugin TheCartPress Local PHP File Inclusion Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A local PHP file inclusion vulnerability exists in the WordPress plugin TheCartPress. Due to input passed to the...

PT-2015-4356

Name of the Vulnerable Software and Affected Versions Dulwich versions prior to 0.9.9 Description The issue allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree. This is due to a...

Ubercart Webform Checkout Pane - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-087

Ubercart Webform Checkout Pane module allows you to define Webform nodes as checkout/order panes in Ubercart. The module doesn't sufficiently sanitize user supplied text in some pages, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an...

CVE-2014-9025

The default checkout completion rule in the commerceorder module in the Drupal Commerce module 7.x-1.x before 7.x-1.10 for Drupal uses the email address as the username for new accounts created at checkout, which allows remote attackers to obtain sensitive information via unspecified vectors...

Default configuration

The default checkout completion rule in the commerceorder module in the Drupal Commerce module 7.x-1.x before 7.x-1.10 for Drupal uses the email address as the username for new accounts created at checkout, which allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2014-9025

The default checkout completion rule in the commerceorder module in the Drupal Commerce module 7.x-1.x before 7.x-1.10 for Drupal uses the email address as the username for new accounts created at checkout, which allows remote attackers to obtain sensitive information via unspecified vectors...

PT-2014-8795

Name of the Vulnerable Software and Affected Versions Drupal Commerce module versions 7.x-1.x before 7.x-1.10 Description The issue in the commerce order module allows remote attackers to obtain sensitive information via unspecified vectors. This is due to the default checkout completion rule usi...

Change CMS 3.6.8 - Multiple CSRF Vulnerabilities

No description provided by source. Exploit Title: RBS Change Complet Open Source multiple CSRF vulnerabilities POST and GET Date: 10/10/2014 Exploit Author: KrustyHack Vendor Homepage: http://www.rbschange.fr/ Software Link:...

Change CMS 3.6.8 - Multiple CSRF Vulnerabilities

Exploit for php platform in category web applications Exploit Title: RBS Change Complet Open Source multiple CSRF vulnerabilities POST and GET Date: 10/10/2014 Exploit Author: KrustyHack Vendor Homepage: http://www.rbschange.fr/ Software Link:...

Checkout Plugin - File Upload Remote Code Execution

The WordPress Checkout WordPress plugin was affected by a File Upload Remote Code Execution security vulnerability...

CVE-2014-5023

Repository.php in Gitter, as used in Gitlist, allows remote attackers with commit privileges to execute arbitrary commands via shell metacharacters in a branch name, as demonstrated by a "git checkout -b" command...

Cross site scripting

Cross-site scripting XSS vulnerability in test-plugin.php in the Swipe Checkout for Jigoshop swipe-hq-checkout-for-jigoshop plugin 3.1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the apiurl parameter...

CVE-2014-4557: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in test-plugin.php in the Swipe Checkout for Jigoshop swipe-hq-checkout-for-jigoshop plugin 3.1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the apiurl parameter...

PT-2014-5976

Name of the Vulnerable Software and Affected Versions Swipe Checkout for Jigoshop plugin versions 3.1.0 and earlier Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the api url parameter...