Adobe Magento Cross-Site Scripting Vulnerability (CNVD-2021-13918)

Adobe Magento is Adobe's one with PHP written in open source e-commerce platform.Magento Community Edition is the community edition, later renamed Magento Open Source, Magento Enterprise Edition is the enterprise edition, later renamed Magento Magento Enterprise Edition is the enterprise edition,...

Adobe Magento XML Injection Vulnerability

Adobe Magento is Adobe's one with PHP written in open source e-commerce platform.Magento Community Edition is the community edition, later renamed Magento Open Source, Magento Enterprise Edition is the enterprise edition, later renamed Magento Magento Enterprise Edition is the enterprise edition,...

Adobe Magento Access Control Bypass Vulnerability

Adobe Magento is Adobe's one with PHP written in open source e-commerce platform.Magento Community Edition is the community edition, later renamed Magento Open Source, Magento Enterprise Edition is the enterprise edition, later renamed Magento Magento Enterprise Edition is the enterprise edition,...

Attackers Exploit Critical Adobe Bug, Target Windows

Adobe is warning of a critical vulnerability that has been exploited in the wild to target Adobe Reader users on Windows. The vulnerability CVE-2021-21017 has been exploited in “limited attacks,” according to Adobe’s Tuesday advisory, part of its regularly scheduled February updates. The flaw in...

nopCommerce Cross-Site Scripting Vulnerability (CNVD-2021-14161)

nopCommerce is an open source e-commerce shopping cart software. A reflective cross-site scripting vulnerability exists in the Discount Coupon component in nopCommerce 4.30. An attacker can exploit this vulnerability to inject arbitrary web script or HTML via the...

Adobe Magento 操作系统命令注入漏洞

Adobe Magento is Adobe's one with PHP written in open source e-commerce platform.Magento Community Edition is the community edition, later renamed Magento Open Source, Magento Enterprise Edition is the enterprise edition, later renamed Magento Magento Enterprise Edition is the enterprise edition,...

WordPress Welcart e-Commerce plugin <= 2.0.0 - SQL injection (SQLi) vulnerability

SQL injection SQLi vulnerability found by Erik David Martin in WordPress Welcart e-Commerce plugin versions = 2.0.0. Solution Update the WordPress Welcart e-Commerce plugin to the latest available version at least 2.0.1...

Arbitrary file download vulnerability exists in ShopXO (CNVD-2021-14523)

ShopXO is an open source enterprise-level open source e-commerce system. ShopXO has an arbitrary file download vulnerability that can be exploited by attackers to obtain sensitive information...

Adobe Magento 代码问题漏洞

Adobe Magento is Adobe's one with PHP written in open source e-commerce platform.Magento Community Edition is the community edition, later renamed Magento Open Source, Magento Enterprise Edition is the enterprise edition, later renamed Magento Magento Enterprise Edition is the enterprise edition,...

Welcart e-Commerce < 2.1.1 - Authenticated SQL Injection

The Welcart e-Commerce WordPress plugin, less than version 2.1.1 and possibly below, was vulnerable to authenticated SQLI Injection in the searchordercolumn0 POST parameter of the "/wp-admin/admin.php?page=uscesorderlist" page. PoC Refer to references...

WordPress Welcart e-Commerce 2.0.0 SQL Injection

Exploit Title: WordPress Plugin Welcart e-Commerce 2.0.0 - 'searchordercolumn0' SQL injection Date: 04/08 2020 Exploit Author: Erik David Martin Vendor Homepage: https://www.welcart.com/ Software Link: https://downloads.wordpress.org/plugin/usc-e-shop.2.0.0.zip Category: Web Application Version:...

Welcart e-Commerce < 2.1.1 - Authenticated SQL Injection

The Welcart e-Commerce WordPress plugin, less than version 2.1.1 and possibly below, was vulnerable to authenticated SQLI Injection in the searchordercolumn0 POST parameter of the "/wp-admin/admin.php?page=uscesorderlist" page. Refer to references...

WordPress Plugin Welcart e-Commerce 2.0.0 - 'search[order_column][0]' SQL injection

Exploit Title: WordPress Plugin Welcart e-Commerce 2.0.0 - 'searchordercolumn0' SQL injection Date: 04/08 2020 Exploit Author: Erik David Martin Vendor Homepage: https://www.welcart.com/ Software Link: https://downloads.wordpress.org/plugin/usc-e-shop.2.0.0.zip Category: Web Application Version:...

Arbitrary file read vulnerability exists in ShopXO (CNVD-2021-15822)

ShopXO is an open source enterprise-level open source e-commerce system. ShopXO has an arbitrary file read vulnerability that can be exploited by attackers to obtain sensitive information...

Arbitrary file deletion vulnerability in ShopXO Pa***.php file

ShopXO is an open source enterprise-level open source e-commerce system. ShopXO Pa.php file contains an arbitrary file deletion vulnerability that can be exploited by an attacker to delete the specified file...

Post-Pandemic world, Shut-downs, and Web Security Connections

As the anniversary of the World Health Organization’s WHO declaration of the COVID-19 pandemic approaches, we, here in Silicon Valley, have great hope for 2021. As the vaccine distribution continues to trickle to Main Street, Californians have recently exited a stay-at-home mandate that has nearl...

‘ValidCC,’ a Major Payment Card Bazaar and Looter of E-Commerce Sites, Shuttered

ValidCC, a dark web bazaar run by a cybercrime group that for more than six years hacked online merchants and sold stolen payment card data, abruptly closed up shop last week. The proprietors of the popular store said their servers were seized as part of a coordinated law enforcement operation...

Magento Web Skimmers Piggyback in Ongoing Costway Website Compromise

Two web skimmers have been discovered on the payment webpages of Costway, one of the top retailers in North America and Europe, which sells appliances, furniture and more. The skimmers are targeting consumers’ credit-card payment details. In a twist, researchers say one of these web skimmers is...

Credit card skimmer piggybacks on Magento 1 hacking spree

Back in the fall of 2020 threat actors started to massively exploit a vulnerability in the no-longer maintained Magento 1 software branch. As a result, thousands of e-commerce shops were compromised and many of them injected with credit card skimming code. While monitoring activities tied to this...

CMSWing SQL Injection Vulnerability

CMSWing is a ThinkJS-based e-commerce platform and CMS builder. A SQL injection vulnerability exists in CMSWing 1.3.8. The vulnerability stems from the rechargeAction function not checking the balance parameter. An attacker can exploit this vulnerability to execute arbitrary SQL commands via...