8857 matches found
PT-2023-28954 · Unknown · Oscommerce
Name of the Vulnerable Software and Affected Versions: Os Commerce affected versions not specified Description: The issue is a Cross-Site Scripting XSS vulnerability that allows attackers to inject JavaScript through the company address parameter. This could potentially lead to unauthorized...
PT-2023-28948 · Unknown · Oscommerce
Name of the Vulnerable Software and Affected Versions: Os Commerce affected versions not specified Description: The issue is a Cross-Site Scripting XSS vulnerability that allows attackers to inject JavaScript through the stock delivery terms text1 parameter. This could potentially lead to...
PT-2023-28927 · Unknown · Oscommerce
Name of the Vulnerable Software and Affected Versions: Os Commerce affected versions not specified Description: The issue is a Cross-Site Scripting XSS vulnerability that allows attackers to inject JavaScript through the configuration title1 parameter. This could potentially lead to unauthorized...
PT-2023-28929 · Unknown · Oscommerce
Name of the Vulnerable Software and Affected Versions: Os Commerce affected versions not specified Description: The issue is a Cross-Site Scripting XSS vulnerability that allows attackers to inject JavaScript through the configuration title1MODULE SHIPPING PERCENT TEXT TITLE parameter. This could...
CVE-2023-43664
PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without any access rights: method ajaxProcessGetPossibleHookingListForModule doesn't check access rights. This issue has been addressed in commit 15bd281c which is...
Design/Logic Flaw
PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, even with low user right. This allows low privileged users to disable portions of a shops functionality. Commit ce1f6708 addresses this issue and is included i...
CVE-2023-43664 Employee without any access rights can list all installed modules in Prestashop
PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without any access rights: method ajaxProcessGetPossibleHookingListForModule doesn't check access rights. This issue has been addressed in commit 15bd281c which is...
CVE-2023-43664
CVE-2023-43664 affects PrestaShop: in the Back Office, an employee can list all modules due to missing access rights check in ajaxProcessGetPossibleHookingListForModule. The root cause is improper authorization in that function. The issue is mitigated in commit 15bd281c and is included in PrestaS...
CVE-2023-43663 Improper Privilege Management in Prestashop
PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, even with low user right. This allows low privileged users to disable portions of a shops functionality. Commit ce1f6708 addresses this issue and is included i...
CVE-2023-43663 Improper Privilege Management in Prestashop
PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, even with low user right. This allows low privileged users to disable portions of a shops functionality. Commit ce1f6708 addresses this issue and is included i...
CVE-2023-43663
PrestaShop vulnerability CVE-2023-43663 affects PrestaShop core where, in affected versions, any module can be disabled or uninstalled from the back office—even by users with low privileges. The issue enables low-privilege users to disable portions of shop functionality, indicating an improper pr...
PrestaShop Security Breach
PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, short message alerts, and product image scaling. A security vulnerability exists in PrestaShop that stems from allowing low privileged users to disable some...
Welcart e-Commerce < 2.8.22 - Editor+ SQL Injection
Description The plugin does not properly sanitize and escape a parameter before using it in an SQL statement, leading to an SQL injection exploitable by users with a role as low as an editor...
OpenCart Path Traversal Vulnerability
OpenCart is a powerful open source e-commerce platform that helps users to quickly build and manage their own online stores. It provides rich functionality and flexible customization options to meet different users' needs. With OpenCart, users can easily add products, process orders, manage...
Welcart e-Commerce < 2.8.22 - Author+ SQL Injection
Description The plugin does not properly sanitize and escape a parameter before using it in an SQL statement, leading to an SQL injection exploitable by users with a role as low as an author...
Welcart e-Commerce < 2.8.22 - Author+ Path Traversal
Description The plugin does not prevent users with author or higher privilege from obtaining partial information of the files on the web server...
Welcart e-Commerce < 2.8.22 - Multiple XSS
Description The plugin does not sanitize and escape a parameter before outputting it back in multiple pages, leading to a Reflected Cross-Site Scripting which could be used against other users...
CVE-2023-43610
SQL injection vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor without setting authority or higher privilege to perform unintended database operations...