Mulitple WordPress Themes (admin-ajax.php, img param) - Arbitrary File Download

No description provided by source. WordPress CuckooTap Theme & eShop Arbitrary File Download Risk: High CWE number: CWE-200 Author: Hugo Santiago Contact: [email protected] Date: 31/08/2014 Vendor Homepage: http://themeforest.net/item/cuckootap-one-page-parallax-wp-theme-plus-eshop/3512405...

CS-Cart 4.2.0 Session Hijacking Vulnerability

CS-Cart version 4.2.0 suffers from a session hijacking vulnerability due to weakly minted session identifiers. Vendor: CS-Cart Homepage: https://www.cs-cart.com Fixed in: v4.2.1 Released: July 22nd 2014 CS-Cart is 127MB of shitty PHP and HTML code that is supposed to function as a secure e-commer...

CS-Cart 4.2.0 Session Hijacking

Vendor: CS-Cart Homepage: https://www.cs-cart.com Fixed in: v4.2.1 Released: July 22nd 2014 CS-Cart is 127MB of shitty PHP and HTML code that is supposed to function as a secure e-commerce site. It is developed by people who don't reply to emails but who covertly patch bugs reported to them and...

Payment Gateways Caller for WP e-Commerce 0.1.0 - load_merchant Parameter Traversal Local file Inclusion

The Payment Gateways Caller for WP e-Commerce WordPress plugin was affected by a loadmerchant Parameter Traversal Local file Inclusion security vulnerability...

Welcart e-Commerce 1.3.12 - DOM Cross-Site Scripting (XSS)

The Welcart e-Commerce WordPress plugin was affected by a DOM Cross-Site Scripting XSS security vulnerability...

Welcart e-Commerce 1.3.12 - SQL Injection

The Welcart e-Commerce WordPress plugin was affected by a SQL Injection security vulnerability...

WordPress Statua Commerce Theme - Remote Code Execution

There is a bug in this theme, that allows any website visitor to run and see the output of any shortcode. This gives unauthenticated visitors the same power to execute code on the server as regular publishers have. Solution Update the theme...

Welcart e-Commerce 1.3.12 - purchase_limit Parameter DOM-based XSS

The Welcart e-Commerce WordPress plugin was affected by a purchaselimit Parameter DOM-based XSS security vulnerability...

e-Commerce <= 3.4 - Arbitrary File Upload Exploit

The wp-shopping-cart WordPress plugin was affected by an Arbitrary File Upload Exploit security vulnerability...

CVE-2014-5104

Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 acountry parameter in a process action to affiliatesignup.php, 2 affiliatebannerid parameter to affiliateshowbanner.php, 3 country parameter in a process action to...

CVE-2014-5105

Multiple cross-site scripting XSS vulnerabilities in ol-commerce 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 acountry parameter in a process action to affiliatesignup.php or 2 entrycountryid parameter in an edit action to admin/createaccount.php...

Sql injection

Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 acountry parameter in a process action to affiliatesignup.php, 2 affiliatebannerid parameter to affiliateshowbanner.php, 3 country parameter in a process action to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ol-commerce 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 acountry parameter in a process action to affiliatesignup.php or 2 entrycountryid parameter in an edit action to admin/createaccount.php...

CVE-2014-5105

Multiple cross-site scripting XSS vulnerabilities in ol-commerce 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 acountry parameter in a process action to affiliatesignup.php or 2 entrycountryid parameter in an edit action to admin/createaccount.php...

CVE-2014-5105

The CVE-2014-5105 entry concerns OL-Commerce 2.1.1 with two reflected XSS vectors: (1) a_country in process action to affiliate_signup.php and (2) entry_country_id in edit action to admin/create_account.php. The underlying issue is cross-site scripting due to unsanitized input in these parameters...

CVE-2014-5104

CVE-2014-5104 affects ol-commerce 2.1.1 and involves multiple SQL injection vulnerabilities in PHP scripts: affiliate_signup.php (a_country), affiliate_show_banner.php (affiliate_banner_id), create_account.php (country), and admin/create_account.php (entry_country_id). The root cause is improper ...

CVE-2014-5104

Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 acountry parameter in a process action to affiliatesignup.php, 2 affiliatebannerid parameter to affiliateshowbanner.php, 3 country parameter in a process action to...

OL-Commerce 2.1.1 Cross Site Scripting / SQL Injection Vulnerabilities

OL-Commerce version 2.1.1 suffers from cross site scripting and remote SQL injection vulnerabilities. OL-Commerce v2.1.1 - Multiple Vulnerabilties =================================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : email protected , email protected .:...

OL-Commerce - OL-Commercecreate_account.php?country SQL Injection

OL-Commerce - OL-Commercecreateaccount.php?country SQL Injection source: https://www.securityfocus.com/bid/68719/info ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input...

OL-Commerce - '/OL-Commerce/create_account.php?country' SQL Injection

source: https://www.securityfocus.com/bid/68719/info ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting these vulnerabilities could allow an attacker to steal...