CVE-2016-4827

Cross-site scripting XSS vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-4826...

CVE-2016-4826: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-4827...

CVE-2016-4828: Undefined Security Weakness

The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress mishandles sessions, which allows remote attackers to obtain access by leveraging knowledge of the e-mail address associated with an account...

PT-2016-6169

Name of the Vulnerable Software and Affected Versions Collne Welcart e-Commerce plugin versions prior to 1.8.3 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations For versions prior to 1.8.3, update t...

PT-2016-6168

Name of the Vulnerable Software and Affected Versions Collne Welcart e-Commerce plugin versions prior to 1.8.3 Description The issue allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted serialized data. This can lead to the execution of...

PT-2016-6171

Name of the Vulnerable Software and Affected Versions Collne Welcart e-Commerce plugin versions prior to 1.8.3 Description The issue is related to the mishandling of sessions, allowing remote attackers to gain access by using the knowledge of the e-mail address associated with an account...

PT-2016-6170

Name of the Vulnerable Software and Affected Versions Collne Welcart e-Commerce plugin versions prior to 1.8.3 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations For versions prior to 1.8.3, update t...

CVE-2016-4827: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-4826...

CVE-2016-4825: Improper Input Validation

The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted serialized data...

WordPress plugin "Welcart e-Commerce" vulnerable to session management

Overview WordPress plugin "Welcart e-Commerce" provided by Collne Inc. contains a vulnerability in session management. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership...

WordPress plugin "Welcart e-Commerce" vulnerable to cross-site scripting

Overview WordPress plugin "Welcart e-Commerce" provided by Collne Inc. contains a cross-site scripting vulnerability CWE-79. Note that this vulnerability is different from JVN95082904. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with t...

WordPress plugin "Welcart e-Commerce" vulnerable to cross-site scripting

Overview WordPress plugin "Welcart e-Commerce" provided by Collne Inc. contains a cross-site scripting vulnerability CWE-79. Note that this vulnerability is different from JVN55826471. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with t...

WordPress plugin "Welcart e-Commerce" vulnerable to PHP object injection

Overview WordPress plugin "Welcart e-Commerce" contains a PHP object injection vulnerability due to a flaw where untrusted POST values are unserialized. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...

Welcart e-Commerce < 1.8.3 - Session Management

The Welcart e-Commerce WordPress plugin was affected by a Session Management security vulnerability...

JVN#47363774: WordPress plugin "Welcart e-Commerce" vulnerable to PHP object injection

WordPress plugin "Welcart e-Commerce" contains a PHP object injection vulnerability due to a flaw where untrusted POST values are unserialized. Impact A remote attacker may execute arbitrary PHP code. Solution Update the Software Update to the latest version according to the information provided ...

Welcart e-Commerce < 1.8.3 - Cross-Site Scripting (XSS)

The Welcart e-Commerce WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

JVN#55826471: WordPress plugin "Welcart e-Commerce" vulnerable to cross-site scripting

WordPress plugin "Welcart e-Commerce" provided by Collne Inc. contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest version according to the information provided by the develope...

JVN#95082904: WordPress plugin "Welcart e-Commerce" vulnerable to cross-site scripting

WordPress plugin "Welcart e-Commerce" provided by Collne Inc. contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest version according to the information provided by the develope...

Welcart e-Commerce < 1.8.3 - PHP Object Injection

The Welcart e-Commerce WordPress plugin was affected by a PHP Object Injection security vulnerability...

JVN#61578437: WordPress plugin "Welcart e-Commerce" vulnerable to session management

WordPress plugin "Welcart e-Commerce" provided by Collne Inc. contains a vulnerability in session management. Impact A remote attacker who knows a user's e-mail address may log in with the user privilege. As a result, arbitrary operations may be conducted. Solution Update the Software Update to t...