CVE-2023-49971

CVE-2023-49971 Customer Support System 1.0 - Vulnerabilidad de Cross-Site Scripting XSS en el campo/parámetro "firstname" en la página "customerlist" Descripción : Customer Support System 1.0 es vulnerable a XSS almacenado. Existe una vulnerabilidad XSS en la versión 1 del Customer Support System...

CVE-2023-50070

CVE-2023-50070 Customer Support System 1.0 - Múltiples vulnerabilidades de inyección SQL - saveticket Descripción : Múltiples vulnerabilidades de inyección SQL en /customersupport/ajax.php?action=saveticket en Customer Support System 1.0 permiten a atacantes autenticados ejecutar comandos SQL...

customer-assistance-buttons-sdr

Investigación sobre Botones de Asistencia al Cliente Este repositorio alberga el trabajo que he dedicado a aplicar ingeniería inversa a los distintos codificadores y protocolos utilizados en los botones de asistencia al cliente en tiendas minoristas como Walgreens, CVS, Lowes y Home Depot. Cada...

CVE-2026-77705 Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the...

CVE-2026-77705

The Amelia (Booking for Appointments and Events Calendar) WordPress plugin before 2.4.10 contains an authorization flaw in its customer/employee record editing feature. The plugin does not verify whether the user editing a record is entitled to modify the linked WordPress account. Users with Amel...

coreweave-demo-2026-05

CoreWeave Demo — Verified Vulnerability Journey May 2026 TL;DR for execs : see DEMO-WALKTHROUGH.md — 8-min top-to-bottom read of the full demo with sample verifier outputs, no execution required. This repository demonstrates an end-to-end verified vulnerability journey for two real-world, publicl...

CVE-2026-68487

Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer...

CVE-2026-68487

Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer...

CVE-2026-68487

CVE-2026-68487 is a path traversal vulnerability in Plesk's Backup Manager caused by an unsigned backup header , allowing an authenticated customer to perform an arbitrary file write as root . The vulnerability is scored CVSS 9.9 (Critical) with a changed scope, reflecting high impact on confiden...

CVE-2026-19439 Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_details

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9...

nCentralDumpsterDiver

SolarWinds n-Central Dumpster Diver Descripción / Explicación Se han publicado CORRECCIONES/SOLUCIONES ALTERNATIVAS; para más información: https://vulners.com/cve/CVE-2020-7984 Esta aplicación utiliza las bibliotecas .NET del agente nCentral para simular el registro del agente y extraer los ajust...

Vulnerability-Playground-CVE-2025-61922

Vulnerability-Playground-CVE-2025-61922 Este playground simula la vulnerabilidad Customer Checkout en PrestaShop...

CVE-2026-80340 Payment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure via order-pay

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that...

WordPress Payment Plugins for PayPal WooCommerce plugin < 2.0.26 - Unauthenticated Customer PII Disclosure vulnerability

Unauthenticated Customer PII Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Payment Plugins for PayPal WooCommerce versions 2.0.26...

Gitea 1.1.0 - 1.12.5 - Remote Code Execution

Gitea 1.1.0 through 1.12.5 is susceptible to authenticated remote code execution, via the git hook functionality, in customer environments where the documentation is not understood e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the...

CVE-2026-7861

Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM Customer Service Management allows Code Injection. This issue affects CSM Customer Service Management: before 8.0.3...

CVE-2026-6377

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Next4Biz Information Technologies Inc. CSM Customer Service Management allows Path Traversal. This issue affects CSM Customer Service Management: from 6.8.9 before 8.0.3...

EUVD-2026-72462

Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM Customer Service Management allows Code Injection. This issue affects CSM Customer Service Management: through 07092026. NOTE: The vendor was contacted early about this disclosure but did not respond in...

CVE-2026-7861 Code Injection in Next4Biz's CSM (Customer Service Management)

Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM Customer Service Management allows Code Injection. This issue affects CSM Customer Service Management: before 8.0.3...

CVE-2026-7861 Code Injection in Next4Biz's CSM (Customer Service Management)

Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM Customer Service Management allows Code Injection. This issue affects CSM Customer Service Management: through 07092026. NOTE: The vendor is continuing efforts to remediate the vulnerability...