CVE-2022-24873 Non-Stored Cross-site Scripting in Shopware storefront

Shopware is an open source e-commerce software platform. Prior to version 5.7.9, Shopware is vulnerable to non-stored cross-site scripting in the storefront. This issue is fixed in version 5.7.9. Users of older versions may attempt to mitigate the vulnerability by using the Shopware security plug...

CVE-2022-24873

Shopware storefront is affected by a non-stored XSS vulnerability in versions prior to 5.7.9. The issue stems from inadequate input handling in the storefront, enabling script injection via URL parameters. It is fixed in version 5.7.9; mitigation guidance in older versions includes using the Shop...

nopCommerce Cross-Site Scripting Vulnerability (CNVD-2022-70103)

nopCommerce is an open source general-purpose e-commerce platform. nopCommerce version 4.50.1 is vulnerable to a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied and output data in the "Text" parameter when creating a new post. An attacker...

Shopware Code Problem Vulnerability (CNVD-2022-31768)

Shopware is a German Shopware company's open source e-commerce software. A code issue vulnerability exists in Shopware that stems from the fact that in the affected version, a user session is not logged off if the password is reset via password recovery. An attacker could exploit the vulnerabilit...

Pimcore Cross-Site Scripting Vulnerability

Pimcore is a set of open source Web content management platform for creating and managing Web applications from Austrian company Pimcore. The platform integrates Web content management, e-commerce framework and product information management applications. cross-site scripting vulnerability exists...

Ecommerce-Website File Upload Vulnerability (CNVD-2022-65360)

Ecommerce-Website is a complete e-commerce website with an administration panel built using PHP and MySql.Ecommerce-Website is vulnerable to file uploads, which can be exploited by attackers to execute arbitrary code via carefully crafted PHP files...

Pimcore SQL Injection Vulnerability (CNVD-2022-85099)

Pimcore is an open source Web content management platform for creating and managing Web applications from Austrian company Pimcore. The platform integrates Web content management, e-commerce framework and product information management applications. pimcore has a SQL injection vulnerability, whic...

Newbee-Mall Cross-Site Scripting Vulnerability

Newbee-Mall is an e-commerce system. Newbee-Mall v1.0.0 contains a security vulnerability that could be exploited by attackers to execute arbitrary Web scripts or HTML via the goodsName parameter of /admin/goods/update...

Newbee-mall code issue vulnerability

newbee-mall is an e-commerce system. newbee-mall v1.0.0 has a security vulnerability that can be exploited by attackers to upload arbitrary files via the upload function of /admin/goods/edit...

Researchers warn of FFDroider and Lightning info-stealers targeting users in the wild

Cybersecurity researchers are warning of two different information-stealing malware, named FFDroider and Lightning Stealer, that are capable of siphoning data and launching further attacks. "Designed to send stolen credentials and cookies to a Command & Control server, FFDroider disguises itself ...

Design/Logic Flaw

Ecommece-Website v1.1.0 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?slides. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

E-Commerce Website 1.1.0 Shell Upload Exploit

Full-Ecommece-Website-Slides-Unrestricted-File-Upload-RCE-POC Author: D4rkP0w4r Description = Upload web shell at Slides in admin panel Step to Reproduct Login to admin - Slides - upload web shell - Submit Exploit Upload web shell at Slides When upload success access...

E-Commerce Website 1.0 Shell Upload

Ecommerce Website Unrestricted File Upload + RCE Author: D4rkP0w4r Note = Create account, don't need login client or admin Description = Create account upload web shell at Customer Image Step to Reproduct Register - upload web shell at Customer Image - clicked Register button Exploit Upload web...

E-Commerce Website 1.1.0 Shell Upload

Full-Ecommece-Website-Slides-Unrestricted-File-Upload-RCE-POC Author: D4rkP0w4r Description = Upload web shell at Slides in admin panel Step to Reproduct Login to admin - Slides - upload web shell - Submit Exploit Upload web shell at Slides When upload success access...

E-Commerce Website 1.0 Shell Upload Exploit

Ecommerce Website Unrestricted File Upload + RCE Author: D4rkP0w4r Note = Create account, don't need login client or admin Description = Create account upload web shell at Customer Image Step to Reproduct Register - upload web shell at Customer Image - clicked Register button Exploit Upload web...

CMSWing SQL Injection Vulnerability (CNVD-2022-84039)

CMSWing is an e-commerce platform and CMS builder based on ThinkJS and MySQL.A SQL injection vulnerability exists in CMSWing version 1.3.7, which stems from the lack of filtering escapes for SQL data in the behavior rules of the parameters. An attacker could use this vulnerability to execute...

Pimcore Cross-Site Scripting Vulnerability (CNVD-2022-22701)

Pimcore is an open source Web content management platform for creating and managing Web applications from the Austrian company Pimcore. The platform integrates Web content management, e-commerce framework and product information management applications. pimcore 10.4.0 prior versions of cross-site...

GHSA-HRF4-HCPC-3345 Denial of service in microweber

Microweber is drag and drop website builder and CMS with E-commerce. The microweber prior 1.2.12 application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service DoS via a crafted HTTP request. The post title input can be limited...

Denial of service in microweber

Microweber is drag and drop website builder and CMS with E-commerce. The microweber prior 1.2.12 application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service DoS via a crafted HTTP request. The post title input can be limited...

Sylius has an unspecified vulnerability (CNVD-2022-22317)

Sylius is an open source e-commerce platform based on the Symfony framework from the Polish company Sylius. sylius has a security vulnerability that stems from the possibility that an attacker-controlled page could load the website in an iframe. This would enable a clickjacking attack where an...