SAP Commerce 安全漏洞

SAP Commerce is a set of cloud-based e-commerce platforms from Germany's SAP. SAP Commerce suffers from an information disclosure vulnerability that originates from a coupon code being exposed in a URL parameter. An attacker could exploit this vulnerability to obtain and use the leaked coupon cod...

WordPress plugin Coupon Plugin 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-1879 · WordPress · Coupon Plugin

Name of the Vulnerable Software and Affected Versions: Coupon Plugin plugin for WordPress versions up to, and including, 1.2.1 Description: The issue is related to Stored Cross-Site Scripting via the Coupon Code parameter due to insufficient input sanitization and output escaping. This allows...

Design/Logic Flaw

The WPGraphQL WooCommerce WordPress plugin before 0.12.4 does not prevent unauthenticated attackers from enumerating a shop's coupon codes and values via GraphQL...

CVE-2022-1563 WPGraphQL WooCommerce <= 0.11.0 - Unauthenticated Coupon Codes Disclosure

The WPGraphQL WooCommerce WordPress plugin before 0.12.4 does not prevent unauthenticated attackers from enumerating a shop's coupon codes and values via GraphQL...

CVE-2022-1563 WPGraphQL WooCommerce <= 0.11.0 - Unauthenticated Coupon Codes Disclosure

The WPGraphQL WooCommerce WordPress plugin before 0.12.4 does not prevent unauthenticated attackers from enumerating a shop's coupon codes and values via GraphQL...

Business Logic Errors

microweber is vulnerable to Business Logic Errors. The vulnerability exists due to a lack of coupon code validation. which allows attackers to change coupon codes and lower prices...

GHSA-QJFX-FVX7-3WVW Business Logic Errors in microweber/microweber

A vulnerability has been identified in microweber where users can purchase items with a coupon code. If the admin disables the use of the coupon code functionality, but the user sends requests to the API that handles the coupon code, the user can exploit the vulnerability and obtain items at a...

Business Logic Errors in microweber/microweber

A vulnerability has been identified in microweber where users can purchase items with a coupon code. If the admin disables the use of the coupon code functionality, but the user sends requests to the API that handles the coupon code, the user can exploit the vulnerability and obtain items at a...

PT-2023-32783 · Microweber · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 2.0 Description: A vulnerability has been identified in microweber where users can exploit business logic errors to obtain items at a lower price. This occurs when the admin disables the use of the coup...

CVE-2023-47308

In the module "Newsletter Popup PRO with Voucher/Coupon code" newsletterpop before version 2.6.1 from Active Design for PrestaShop, a guest can perform SQL injection in affected versions. The method NewsletterpopsendVerificationModuleFrontController::checkEmailSubscription has sensitive SQL calls...

PT-2023-17007 · WordPress · Wp Express Checkout

Name of the Vulnerable Software and Affected Versions: WP Express Checkout plugin for WordPress versions up to, and including, 2.2.8 Description: The issue is related to Stored Cross-Site Scripting via the pec couponcode parameter due to insufficient input sanitization and output escaping. This...

No Rate Limit on Copoun Code Functionality

Description The attacker has the ability to send any number of requests to the endpoint due to the absence of rate-limiting. Steps to reproduce - Simply capture the adding coupon request and send it to burp. - Send it to the repeater tab and you will be able to send many requests without blocking...

LifterLMS < 4.21.1 - Reflected Cross-Site Scripting (XSS) via Coupon Code in Checkout

The plugin did not properly sanitise the coupon code during checkout before outputting in back the error message in the page, leading to a reflected Cross-Site Scripting issue...

How to Avoid Spam—Using Disposable Contact Information

The next time you sign up for a coupon code or retail promotion, use these apps to avoid spam text and email messages...

Top 5 Last-Minute Memorial Day Deals at THN Store → Get 60% Extra OFF

Memorial Day has come and gone, but you still have time to land some of the best deals on some of the best apps and tech training bundles around. Whether you're looking for a world-class VPN or want to begin a career as a high-paid ethical hacker or IT pro, this list of ultra-discounted apps and...

WordPress MemberMouse SQL Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL servers to set up personal blog sites.MemberMouse plugin is used in one of the sales management plugin. A SQL injection vulnerability exists in the...

CVE-2018-11309

Blind SQL injection in couponcode in the MemberMouse plugin 2.2.8 and prior for WordPress allows an unauthenticated attacker to dump the WordPress MySQL database via an applyCoupon action in an admin-ajax.php request...

Get the passenger and the owner of the personal information? This note Uber logical vulnerability“combination punches”worth a look-vulnerability warning-the black bar safety net

! Uber recently finally opened up its vulnerability reward program, and encourage white-hat gate expand on the Uber online service vulnerability mining. Please with FreeBuf xiaobian together look at this a few logical loopholes the formation of“combination of Boxing” it. Information collected...

Udemy: Able to view others' gifts on /gift/share URL, giftId is predictable, and easy to manipulate

I recently purchased a gift for a friend, and noticed the share URL gift ID was simply numeric. I managed to access other people's gifts simply by incrementing and decrementing the ID by 2, I was able to verify that the price was dropped to "Free", regardless of if I was logged in or not, and I w...