AbanteCart Arbitrary File Upload / Cross Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: AbanteCart e-commerce platform vulnerable version: 1.3.2 fixed version: 1.3.2 CVE number: CVE-2021-42050, CVE-2021-42051 impact: Medium...

Unspecified Vulnerability in Smartstore SmartStoreNET

Smartstore SmartStoreNET is an open source e-commerce Web platform of Germany Smartstore company . The platform includes CRM, CMS, sales, marketing, payment, order processing and other functions. A security vulnerability exists in SmartstoreNET version 4.1.1. The vulnerability stems from the...

Sylius Unauthorized Access Vulnerability

Sylius is a Polish company Sylius set of open source e-commerce platform based on the Symfony framework . A security vulnerability exists in Sylius versions prior to 1.9.5 and 1.10.0-RC, which stems from the fact that some of the details of an order placed in Sylius order ID, order number, total...

Shopware Unauthorized Access Vulnerability

Shopware is an open source e-commerce platform. An unauthorized access vulnerability exists in Shopware versions prior to 6.4.1.1. An attacker can exploit the vulnerability to gain direct access to private files stored at a cloud storage provider with a known hash url...

Shopware Information Disclosure Vulnerability

Shopware is an open source e-commerce platform. An information disclosure vulnerability exists in Shopware versions prior to 6.4.1.1. An attacker can exploit the vulnerability to expose internal hidden fields via the Management API when loading multiple references in an association...

Shanghai Danfan Network Science and Technology Co., Ltd. builds website system with SQL injection vulnerability (CNVD-2021-45217)

Huaxia Chemical Network was founded in 2000, is founded by Shanghai Danfan Network Technology Co., Ltd, is for the chemical industry to provide safe, efficient, multi-functional, systematic supporting B2B e-commerce platform of professional website. Shanghai Danfan network science and technology...

CMSWing Cross-Site Scripting Vulnerability (CNVD-2021-37204)

CMSWing is an e-commerce platform and CMS building system based on ThinkJS and MySQL. A cross-site scripting vulnerability exists in CmsWing version 1.3.7, which stems from a vulnerability that is triggered when a visitor accesses the Articles module. No detailed vulnerability details are availab...

CMSWing Cross-Site Scripting Vulnerability

CMSWing is an e-commerce platform and CMS building system based on ThinkJS and MySQL. A cross-site scripting vulnerability exists in CmsWing version 1.3.7, which stems from a vulnerability that is triggered when an administrator accesses the content management module. No detailed vulnerability...

Unspecified Vulnerability in Smartstore SmartStoreNET

Smartstore SmartStoreNET is an open source e-commerce Web platform of Germany Smartstore company . The platform includes CRM, CMS, sales, marketing, payment, order processing and other functions. A security vulnerability exists in Smartstore that allows CommonController.ClearCache,...

Smartstore SmartStoreNET Directory Traversal Vulnerability

Smartstore SmartStoreNET is an open source e-commerce Web platform of Germany Smartstore company . The platform includes CRM, CMS, sales, marketing, payment, order processing and other functions. A security vulnerability exists in Smartstore versions prior to 4.1.0 that allows path traversal in...

Command Execution Vulnerability in UFIDA NC (CNVD-2021-36505)

UFIDA NC is a large erp enterprise management system and e-commerce platform. UFIDA NC suffers from a command execution vulnerability that can be exploited by an attacker to gain control of the server...

Command Execution Vulnerability in UFIDA NC

UFIDA NC is a large erp enterprise management system and e-commerce platform. UFIDA NC suffers from a command execution vulnerability that can be exploited by an attacker to gain control of the server...

Apache OFBiz RCE Vulnerability

Apache OFBiz is an e-commerce platform for building medium-sized and large enterprise-class, cross-platform, cross-database, cross-application server multi-tier, distributed e-commerce applications. An RCE vulnerability exists in Apache OFBiz. An unauthenticated attacker can exploit this...

SQL Injection Vulnerability in Dascommerce Multi-User Mall System 2.0 Home Page

Large business creation multi-user mall system is mainly oriented to the high-end enterprise-level users, to create self-operated + investment in the e-commerce platform similar to the diversified business model of Jingdong, Tmall, the group purchase, e-commerce retail, wholesale in one, to help...

SQL Injection Vulnerability in Tesco Mall System

Tesco mall system for the majority of small and medium-sized enterprises to develop a professional-level e-commerce mall platform system. Ease2Shop Mall system has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

Smartstore SmartStoreNET Cross-Site Request Forgery Vulnerability

Smartstore SmartStoreNET is an open source e-commerce Web platform of Germany Smartstore company . The platform includes CRM, CMS, sales, marketing, payment, order processing and other functions. A cross-site request forgery vulnerability exists in Smartstore SmartStoreNET versions prior to 4.1.0...

Adobe Magento Cross-Site Scripting Vulnerability (CNVD-2021-13918)

Adobe Magento is Adobe's one with PHP written in open source e-commerce platform.Magento Community Edition is the community edition, later renamed Magento Open Source, Magento Enterprise Edition is the enterprise edition, later renamed Magento Magento Enterprise Edition is the enterprise edition,...

Adobe Magento Access Control Bypass Vulnerability

Adobe Magento is Adobe's one with PHP written in open source e-commerce platform.Magento Community Edition is the community edition, later renamed Magento Open Source, Magento Enterprise Edition is the enterprise edition, later renamed Magento Magento Enterprise Edition is the enterprise edition,...

Adobe Magento Command Injection Vulnerability

Adobe Magento is Adobe's one with PHP written in open source e-commerce platform.Magento Community Edition is the community edition, later renamed Magento Open Source, Magento Enterprise Edition is the enterprise edition, later renamed Magento Magento Enterprise Edition is the enterprise edition,...

Adobe Magento Cross-Site Scripting Vulnerability (CNVD-2021-13917)

Adobe Magento is Adobe's one with PHP written in open source e-commerce platform.Magento Community Edition is the community edition, later renamed Magento Open Source, Magento Enterprise Edition is the enterprise edition, later renamed Magento Magento Enterprise Edition is the enterprise edition,...