Cross site scripting

Cross-site scripting XSS vulnerability in test-plugin.php in the Swipe Checkout for eShop plugin 3.7.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the apiurl parameter...

CVE-2014-4556

Cross-site scripting XSS vulnerability in test-plugin.php in the Swipe Checkout for eShop plugin 3.7.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the apiurl parameter...

CVE-2014-4556

The CVE-2014-4556 entry concerns the WordPress Swipe Checkout for eShop plugin (versions 3.7.0 and earlier), where a Cross-Site Scripting (XSS) vulnerability exists in test-plugin.php. The underlying issue is that the api_url parameter can be used by remote attackers to inject arbitrary web scrip...

OSCommerce 2.1/2.2 Checkout_Payment.PHP Error Output Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7155/info Error output is not sufficiently sanitized of HTML and script code by osCommerce. This may allow for cross-site scripting attacks as remote users could create a malicious link to a site hosting osCommerce which...

CVE-2014-4556: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in test-plugin.php in the Swipe Checkout for eShop plugin 3.7.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the apiurl parameter...

PT-2014-5975

Name of the Vulnerable Software and Affected Versions Swipe Checkout for eShop plugin versions 3.7.0 and earlier Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the api url paramete...

WordPress Swipe Checkout for eShop Plugin <= 3.7.0 - XSS

Because of this vulnerability in test-plugin.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

WordPress Swipe Checkout for Jigoshop Plugin <= 3.1.0 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "apiurl" parameter. Solution Update the plugin...

CuuMall商城系统v2.3 储存型xss

简要描述： rt 详细说明： 收货地址处 提交订单 。后台 查看时 触发 可打cookie 后台getshell姿势很多。就不多说了。 关键字 ： Power by CuuMall 还是有一定 用户量的 漏洞证明：...

PT-2014-3345

Name of the Vulnerable Software and Affected Versions Ubercart module versions 6.x-2.x through 6.x-2.12 Ubercart module versions 7.x-3.x through 7.x-3.5 Description The issue allows remote attackers to hijack web sessions by leveraging knowledge of the original session ID, specifically when the...

WordPress WP-Checkout Cross Site Scripting / Shell Upload

Title : Wordpress Plugin wp-checkout XSS / Arbitrary File Upload Author : DevilScreaM Date : 10/31/2013 Category : Web Applications Type : PHP Greetz : 0day-id.com | newbie-security.or.id | Borneo Security | Indonesian Security Indonesian Hacker | Indonesian Exploiter | Indonesian Cyber Thanks :...

Easy CMS enterprise built Station system vulnerability 0day-vulnerability warning-the black bar safety net

Easy CMS enterprise built Station system vulnerability 0day in injection: The relevant code: ........................ Omitted part of the.................................... id=request"id":id1=SplitIDs,", ":delid=replacerequest"id","'","" set rs = server. createobject"adodb. recordset" sql="DELET...

Code injection

google-checkout-php-sample-code before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2011-5238

CVE-2011-5238 affects google-checkout-php-sample-code up to version 1.3.1. The issue is inadequate TLS hostname verification: the code does not ensure the server hostname matches CN/subjectAltName, enabling MITM with any valid certificate. Impact per note: partial confidentiality and integrity; n...

CVE-2011-5238: Improper Input Validation

google-checkout-php-sample-code before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

PT-2012-2215

Name of the Vulnerable Software and Affected Versions google-checkout-php-sample-code versions prior to 1.3.2 Description The issue arises from the failure to verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate. Th...

CVE-2012-4934

TomatoCart 1.1.7 (and possibly other versions) with the PayPal Express Checkout module in sandbox mode contains a design/logic flaw that may allow an attacker who is authenticated to bypass payment requirements by manipulating the PayPal redirect URL from PayPal back to TomatoCart. The result can...

PT-2012-5668

Name of the Vulnerable Software and Affected Versions TomatoCart version 1.1.7 Description The issue allows remote authenticated users to bypass intended payment requirements. This is possible when the PayPal Express Checkout module is enabled in sandbox mode, and a certain redirection URL is...

CVE-2012-4934: Undefined Security Weakness

TomatoCart 1.1.7, when the PayPal Express Checkout module is enabled in sandbox mode, allows remote authenticated users to bypass intended payment requirements by modifying a certain redirection URL...

TomatoCart with PayPal Express Checkout design flaw vulnerability

Overview TomatoCart 1.1.7 with PayPal Express Checkout, and possibly other versions, contains a design flaw that may allow an attacker to purchase items for free or less than advertised. Description It has been reported that TomatoCart 1.1.7 using the PayPal Express Checkout module in sandbox mod...