CVE-2023-40532

Path traversal vulnerability in Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to obtain partial information of the files on the web server...

CVE-2023-40532

Path traversal vulnerability in Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to obtain partial information of the files on the web server...

CVE-2023-40532

Welcart e-Commerce contains a path traversal vulnerability (CVE-2023-40532) affecting versions 2.7–2.8.21. A user with author or higher privilege can obtain partial information about server files. Red Hat, JVN, and WPVulndb entries align on the issue and remediation guidance. The fix is to update...

CVE-2023-40219

Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor or higher privilege to upload an arbitrary file to an unauthorized directory...

CVE-2023-40219

CVE-2023-40219 affects Welcart e-Commerce (plugin version 2.7–2.8.21 ) where an user with editor or higher privileges can upload an arbitrary file to an unauthorized directory. The associated vulnerability entry notes an Authenticated (Editor+) Arbitrary File Upload with high impact (CVSS v3.1: A...

CVE-2023-40219

Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor or higher privilege to upload an arbitrary file to an unauthorized directory...

PT-2023-27335 · Unknown · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce versions 2.7 to 2.8.21 Description: The issue allows a user with editor or higher privilege to upload an arbitrary file to an unauthorized directory. Recommendations: For Welcart e-Commerce versions 2.7 to 2.8.21, consider...

CVE-2023-40219: Unrestricted Upload of File with Dangerous Type

Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor or higher privilege to upload an arbitrary file to an unauthorized directory...

PT-2023-27500 · Unknown · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce versions 2.7 to 2.8.21 Description: The issue allows a user with author or higher privilege to obtain partial information of the files on the web server due to a path traversal vulnerability. Recommendations: For Welcart...

PT-2023-28843 · Unknown · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce versions 2.7 to 2.8.21 Description: The issue allows a user with author or higher privilege to obtain sensitive information through a SQL injection vulnerability in the Item List page. Recommendations: For Welcart e-Commerc...

CVE-2023-41962: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in Credit Card Payment Setup page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script in the page...

CVE-2023-40532: Improper Limitation of a Pathname to a Restricted Directory

Path traversal vulnerability in Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to obtain partial information of the files on the web server...

CVE-2023-43610: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor without setting authority or higher privilege to perform unintended database operations...

PT-2023-28193

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce versions 2.7 to 2.8.21 Description A cross-site scripting issue in the Credit Card Payment Setup page allows a remote unauthenticated attacker to inject an arbitrary script into the page. This enables the attacker to execute...

PT-2023-28874

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce versions 2.7 to 2.8.21 Description The issue allows a user with editor or higher privilege to perform unintended database operations due to a SQL injection vulnerability in the Order Data Edit page. Recommendations For Welca...

CVE-2023-43484: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script...

PT-2023-27857 · Unknown · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce versions 2.7 to 2.8.21 Description: A cross-site scripting issue exists in the Item List page registration process, allowing a remote unauthenticated attacker to inject an arbitrary script. Recommendations: For Welcart...

CVE-2023-41233: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in Item List page registration process of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script...

CVE-2023-43493: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to obtain sensitive information...

PT-2023-28840 · Unknown · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce versions 2.7 to 2.8.21 Description: The issue allows a remote unauthenticated attacker to inject an arbitrary script in the Item List page. This is a cross-site scripting vulnerability. Recommendations: For Welcart e-Commer...