The vulnerability of the Magento Commerce software platform for developing and managing online stores stems from incorrect restrictions on the path to the restricted catalog. This allows attackers to write arbitrary files into the device’s file system.

The vulnerability of the Magento Commerce development and management software platform is related to incorrect restrictions on the path name used to access the restricted catalog. Exploiting this vulnerability allows a malicious actor to write arbitrary files to the device’s file system...

CVE-2021-28563 Magento Commerce improper Authorization via the 'Create Customer' endpoint

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to...

CVE-2021-28556 Magento Commerce DOM-based cross-site scripting (XSS) could lead to arbitrary javascript execution

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthenticated attacker. User interaction is...

Shopware Unauthorized Access Vulnerability

Shopware is an open source e-commerce platform. An unauthorized access vulnerability exists in Shopware versions prior to 6.4.1.1. An attacker can exploit the vulnerability to gain direct access to private files stored at a cloud storage provider with a known hash url...

Shopware Information Disclosure Vulnerability (CNVD-2021-45748)

Shopware is an open source e-commerce platform. A sensitive information disclosure vulnerability exists in versions of Shopware prior to 5.6.10. An attacker can exploit this vulnerability to obtain leaked system information via Error Handler...

Online Pet Shop Web App SQL注入漏洞

Online Pet Shop Web App is an open source web application. It is used for e-commerce or online stores. A SQL injection vulnerability exists in Online Pet Shop Web App. The vulnerability stems from a lack of validation of externally entered SQL statements in a database-based application. An attack...

Shopware Information Disclosure Vulnerability

Shopware is an open source e-commerce platform. An information disclosure vulnerability exists in Shopware versions prior to 6.4.1.1. An attacker can exploit the vulnerability to expose internal hidden fields via the Management API when loading multiple references in an association...

crmeb server-side request forgery vulnerability

Zhongbang CRMEB is an open source e-commerce management system from Zhongbang Networks Zhongbang in Xi'an, China. A security vulnerability exists in CRMEB 3.1.0+, which stems from the strict domain name filtering in CRMEB 3.1.0+ leading to SSRF Server Side Request Forgery. No detailed vulnerabili...

CVE-2021-20734

Cross-site scripting vulnerability in Welcart e-Commerce versions prior to 2.2.4 allows remote attackers to inject arbitrary script or HTML via unspecified vectors...

CVE-2021-20734

Cross-site scripting vulnerability in Welcart e-Commerce versions prior to 2.2.4 allows remote attackers to inject arbitrary script or HTML via unspecified vectors...

CVE-2021-20734

Cross-site scripting vulnerability in Welcart e-Commerce versions prior to 2.2.4 allows remote attackers to inject arbitrary script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting vulnerability in Welcart e-Commerce versions prior to 2.2.4 allows remote attackers to inject arbitrary script or HTML via unspecified vectors...

CVE-2021-20734

Cross-site scripting vulnerability in Welcart e-Commerce versions prior to 2.2.4 allows remote attackers to inject arbitrary script or HTML via unspecified vectors...

CVE-2021-20734

CVE-2021-20734 concerns the WordPress plugin Welcart e-Commerce . Connected sources confirm a cross-site scripting (XSS) vulnerability in versions prior to 2.2.4 , allowing remote attackers to inject arbitrary script/HTML via unspecified vectors. The issue affects the plugin in the WordPress ecos...

Ec-Cube cross-site scripting vulnerability (CNVD-2021-46279)

Ec-cube is an open source e-commerce system of the Japanese company Ec-cube . A cross-site scripting vulnerability exists in Ec-Cube, which can be exploited by a remote attacker to inject specially crafted scripts into specific input fields of an EC website created using EC-Cube and execute...

File upload vulnerability in Speedcat ERP backend management system

Ltd. is an e-commerce management product specially developed for cross border e-commerce platforms such as Selling, Amazon and Ebay. There is a file upload vulnerability in the Quickcat ERP backend management system, which can be exploited by attackers to control the server by uploading Trojan...

File Upload Vulnerability in Merchant Management System of Xiamen Lionfish Network Technology Co.

Xiamen Lionfish Network Technology Co., Ltd. is an Internet innovation model software products and solutions as the core, mainly focusing on e-commerce system development and business solutions for high-tech enterprises. There is a file upload vulnerability in the merchant management system of...

Shanghai Danfan Network Science and Technology Co., Ltd. builds website system with SQL injection vulnerability (CNVD-2021-45217)

Huaxia Chemical Network was founded in 2000, is founded by Shanghai Danfan Network Technology Co., Ltd, is for the chemical industry to provide safe, efficient, multi-functional, systematic supporting B2B e-commerce platform of professional website. Shanghai Danfan network science and technology...

WordPress plugin "Welcart e-Commerce" vulnerable to cross-site scripting

Overview WordPress plugin "Welcart e-Commerce" provided by Collne Inc. contains a stored cross-site scripting vulnerability CWE-79. Yu Iwama of Secure Sky Technology Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

WordPress Welcart e-Commerce plugin <= 2.2.3 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability discovered by Yu Iwama in WordPress Welcart e-Commerce plugin versions = 2.2.3. Solution Update the WordPress Welcart e-Commerce plugin to the latest available version at least 2.2.4...