CVE-2023-30839

PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO user can write, update, and delete in the database, even without having specific rights. PrestaShop 8.0.4 and 1.7.8.9 contain a patch for this issue. There are ...

Cross site scripting

PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, the ValidateCore::isCleanHTML method of Prestashop misses hijackable events which can lead to cross-site scripting XSS injection, allowed by the presence of pre-setup @keyframes methods. This XSS, which...

CVE-2023-30839

PrestaShop vulnerability CVE-2023-30839 affects versions older than 8.0.4 and 1.7.8.9, with a SQL filtering flaw that lets a back‑office (BO) user write, update, and delete data despite limited rights. The issue is mitigated by patches in 8.0.4 and 1.7.8.9; no public workarounds are documented in...

CVE-2023-30839 PrestaShop vulnerable to SQL filter bypass leading to arbitrary write requests using "SQL Manager"

PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO user can write, update, and delete in the database, even without having specific rights. PrestaShop 8.0.4 and 1.7.8.9 contain a patch for this issue. There are ...

CVE-2023-30838

PrestaShop suffers a XSS vulnerability (CVE-2023-30838) where ValidateCore::isCleanHTML() misses hijackable events, allowing attribute hijacking via pre-setup @keyframes. Affected versions are prior to 8.0.4 and 1.7.8.9. The issue can be triggered without user interaction, potentially impacting a...

CVE-2023-30838 PrestaShop vulnerable to possible XSS injection through Validate::isCleanHTML method

PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, the ValidateCore::isCleanHTML method of Prestashop misses hijackable events which can lead to cross-site scripting XSS injection, allowed by the presence of pre-setup @keyframes methods. This XSS, which...

CVE-2023-30545

The CVE-2023-30545 vulnerability affects PrestaShop prior to versions 8.0.4 and 1.7.8.9. A user with access to the SQL Manager (Advanced Options → Database) can read arbitrary files on the operating system by using the SQL function LOAD_FILE in a SELECT request, exposing confidential information....

Apache OFBiz arbitrary file reading vulnerability

Apache OFBiz is an e-commerce platform for building medium and large enterprise, cross-platform, cross-database, cross-application server multi-tier, distributed e-commerce class applications.Apache OFBiz suffers from an arbitrary file read vulnerability that could be exploited by attackers to...

CVE-2023-22705

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Collne Inc. Welcart e-Commerce plugin = 2.8.10 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Collne Inc. Welcart e-Commerce plugin = 2.8.10 versions...

CVE-2023-22705 WordPress Welcart e-Commerce Plugin <= 2.8.10 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Collne Inc. Welcart e-Commerce plugin = 2.8.10 versions...

CVE-2023-22705 WordPress Welcart e-Commerce Plugin <= 2.8.10 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Collne Inc. Welcart e-Commerce plugin = 2.8.10 versions...

CVE-2023-22705

CVE-2023-22705 concerns an unauthenticated, reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Welcart e-Commerce by Collne Inc., affecting versions

PT-2023-18648 · Collne · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Collne Inc. Welcart e-Commerce plugin versions prior to 2.8.11 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This vulnerability allows for reflected cross-site scripting attacks without...

WordPress Plugin Welcart e-Commerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Google Suspends Chinese E-Commerce App Pinduoduo Over Malware

Google says it has suspended the app for the Chinese e-commerce giant Pinduoduo after malware was found in versions of the software. The move comes just weeks after Chinese security researchers published an analysis suggesting the popular e-commerce app sought to seize total control over affected...

CVE-2023-1569

A vulnerability classified as problematic was found in SourceCodester E-Commerce System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/user/controller.php?action=edit. The manipulation of the argument UNAME with the input alert'1' leads to cross site scripting...

CVE-2023-1569

A vulnerability classified as problematic was found in SourceCodester E-Commerce System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/user/controller.php?action=edit. The manipulation of the argument UNAME with the input alert'1' leads to cross site scripting...

Cross site scripting

A vulnerability classified as problematic was found in SourceCodester E-Commerce System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/user/controller.php?action=edit. The manipulation of the argument UNAME with the input alert'1' leads to cross site scripting...

CVE-2023-1569 SourceCodester E-Commerce System cross site scripting

A vulnerability classified as problematic was found in SourceCodester E-Commerce System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/user/controller.php?action=edit. The manipulation of the argument UNAME with the input alert'1' leads to cross site scripting...