EC-CUBE 路径遍历漏洞

EC-CUBE is an open source e-commerce system from EC-CUBE Japan. A security vulnerability exists in EC-CUBE versions 3.0.0 to 3.0.18-p4 and 4.0.0 to 4.1.2, which stems from a directory traversal issue that allows a remote attacker logged in to a product to obtain information about the product's...

JVN#21213852: Multiple vulnerabilities in EC-CUBE

EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple vulnerabilities listed below. Directory traversal vulnerability CWE-22 - CVE-2022-40199 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N| Base Score: 2.7 CVSS v2| AV:N/AC:L/Au:S/C:P/I:N/A:N| Base Score:...

EC-CUBE 跨站脚本漏洞

EC-CUBE is an open source e-commerce system from the Japanese company EC-CUBE. A security vulnerability exists in EC-CUBE versions 4.0.0 through 4.1.2, which stems from a DOM-based cross-site scripting vulnerability that could allow a remote attacker to execute arbitrary script on the...

JVN#30900552: EC-CUBE plugin "Product Image Bulk Upload Plugin" vulnerable to insufficient verification in uploading files

EC-CUBE plugin "Product Image Bulk Upload Plugin", a plugin that enables to upload image files, provided by EC-CUBE CO.,LTD. contains an insufficient verification vulnerability when uploading files CWE-20. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary...

EC-CUBE 代码问题漏洞

EC-CUBE is an open source e-commerce system from EC-CUBE Japan. A security vulnerability exists in EC-CUBE Plugin Product Image Bulk Upload Plugin 1.0.1 and earlier versions, which stems from insufficient authentication when uploading files and can be exploited by remote attackers to upload...

cube-fitnessclub.de Cross Site Scripting vulnerability OBB-2685144

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-27174

Cross-site request forgery CSRF vulnerability in Easy Blog for EC-CUBE4 Ver.1.0.1 and earlier allows a remote unauthenticated attacker to hijack the authentication of the administrator and delete a blog article or a category via a specially crafted page...

CVE-2022-27174

Cross-site request forgery CSRF vulnerability in Easy Blog for EC-CUBE4 Ver.1.0.1 and earlier allows a remote unauthenticated attacker to hijack the authentication of the administrator and delete a blog article or a category via a specially crafted page...

WordPress Cube Slider plugin SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The WordPress plugin is an application plugin. The WordPress Cube Slider plugin 1.2 and earlier versions are vulnerable to SQL injection, which...

CVE-2022-1684

The Cube Slider WordPress plugin through 1.2 does not sanitise and escape the idslider parameter before using it in various SQL queries, leading to SQL Injections exploitable by high privileged users such as admin...

CVE-2022-1684

The Cube Slider WordPress plugin through 1.2 does not sanitise and escape the idslider parameter before using it in various SQL queries, leading to SQL Injections exploitable by high privileged users such as admin...

CVE-2022-1684

The Cube Slider WordPress plugin through 1.2 does not sanitise and escape the idslider parameter before using it in various SQL queries, leading to SQL Injections exploitable by high privileged users such as admin...

Sql injection

The Cube Slider WordPress plugin through 1.2 does not sanitise and escape the idslider parameter before using it in various SQL queries, leading to SQL Injections exploitable by high privileged users such as admin...

WordPress plugin Cube Slider SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The WordPress plugin is an application plugin. The WordPress Cube Slider plugin 1.2 and earlier versions are vulnerable to SQL injection, which...

CVE-2022-1684 Cube Slider <= 1.2 - Admin+ SQLi

The Cube Slider WordPress plugin through 1.2 does not sanitise and escape the idslider parameter before using it in various SQL queries, leading to SQL Injections exploitable by high privileged users such as admin...

CVE-2022-1684

The CVE-2022-1684 entry concerns the WordPress Cube Slider plugin (versions ≤ 1.2). The root cause is failure to sanitize and escape the idslider parameter before use in SQL queries, enabling SQL injection. The vulnerability is described as exploitable by high-privilege users (e.g., admin); Patch...

CVE-2022-1684: Improper Neutralization of Special Elements used in an SQL Command

The Cube Slider WordPress plugin through 1.2 does not sanitise and escape the idslider parameter before using it in various SQL queries, leading to SQL Injections exploitable by high privileged users such as admin...

GHSA-M9HV-QMQH-33QH EC-CUBE Cross-site request forgery (CSRF) vulnerability

Cross-site request forgery CSRF vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page...

EC-CUBE Cross-site request forgery (CSRF) vulnerability

Cross-site request forgery CSRF vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page...

EC-CUBE Improper access control vulnerability

Improper access control vulnerability in EC-CUBE 4.0.6 EC-CUBE 4 series allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified vectors...