JVN#70566757: WordPress plugin "Welcart e-Commerce" vulnerable to cross-site scripting

WordPress plugin "Welcart e-Commerce" provided by Collne Inc. contains a stored cross-site scripting vulnerability CWE-79. Impact If a user views a malicious page while logged in to the affected system with the administrative privilege, an arbitrary script may be executed. Solution Update the...

Command Execution Vulnerability in CRMEB Min Open Source Mall

CRMEB Min open source mall is a front and back end separation of open source e-commerce system . A command execution vulnerability exists in CRMEB Min Open Source Mall. An attacker can exploit this vulnerability to obtain server administrative privileges...

CRMEB Min open source mall suffers from an arbitrary file read vulnerability

CRMEB Min open source mall is a front and back end separation of open source e-commerce system . CRMEB Min open source mall has an arbitrary file read vulnerability. An attacker can use this vulnerability to read any file on the server...

Unspecified Vulnerability in Devellion Cubecart

Devellion CubeCart is a free and open source e-commerce shopping cart software from the company of Devellion UK. The software supports selling products, adding/editing products or images in an online store, etc. A security vulnerability exists in Cubecart version 6.4.2, which stems from the...

Shopizer Cross-Site Scripting Vulnerability

Shopizer is a Java open source e-commerce software. A stored cross-site scripting vulnerability exists in Shopizer versions prior to 2.17.0. A remote attacker can exploit this vulnerability to inject arbitrary Web script or HTML via the customername in various forms managed by the store...

CMSWing Cross-Site Scripting Vulnerability

CMSWing is an e-commerce platform and CMS building system based on ThinkJS and MySQL. A cross-site scripting vulnerability exists in CmsWing version 1.3.7, which stems from a vulnerability that is triggered when an administrator accesses the content management module. No detailed vulnerability...

CMSWing Cross-Site Scripting Vulnerability (CNVD-2021-37204)

CMSWing is an e-commerce platform and CMS building system based on ThinkJS and MySQL. A cross-site scripting vulnerability exists in CmsWing version 1.3.7, which stems from a vulnerability that is triggered when a visitor accesses the Articles module. No detailed vulnerability details are availab...

Smartstore SmartStoreNET Directory Traversal Vulnerability

Smartstore SmartStoreNET is an open source e-commerce Web platform of Germany Smartstore company . The platform includes CRM, CMS, sales, marketing, payment, order processing and other functions. A security vulnerability exists in Smartstore versions prior to 4.1.0 that allows path traversal in...

Unspecified Vulnerability in Smartstore SmartStoreNET

Smartstore SmartStoreNET is an open source e-commerce Web platform of Germany Smartstore company . The platform includes CRM, CMS, sales, marketing, payment, order processing and other functions. A security vulnerability exists in Smartstore that allows CommonController.ClearCache,...

Ltd. TPshop open source mall system there are directory traversal vulnerabilities

Ltd. is a professional e-commerce software development, service providers. Ltd. TPshop open source mall system directory traversal vulnerabilities, attackers can use the vulnerability to obtain sensitive information...

SQL Injection Vulnerability in Cross-border E-commerce Integrated Platform of Hualei Information Technology Co.

Ltd. is a professional information technology service provider, the use of cutting-edge science and technology, we focus on providing efficient, high-quality information technology solutions and information technology products and services for logistics enterprises. A SQL injection vulnerability...

Magecart Goes Server-Side in Latest Tactics Changeup

Magecart Group 12, known for skimming payment information from online shoppers, was fingered for last September’s gonzo attack on more than 2,000 e-Commerce sites, and now researchers have issued a report explaining how they did it, detailing a new technical approach. The skimmers are still “very...

Magecart Hackers Now hide PHP-Based Backdoor In Website Favicons

Cybercrime groups are distributing malicious PHP web shells disguised as a favicon to maintain remote access to the compromised servers and inject JavaScript skimmers into online shopping platforms with an aim to steal financial information from their users. "These web shells known as Smilodon or...

Command Execution Vulnerability in UFIDA NC (CNVD-2021-36505)

UFIDA NC is a large erp enterprise management system and e-commerce platform. UFIDA NC suffers from a command execution vulnerability that can be exploited by an attacker to gain control of the server...

EC-CUBE cross-site scripting vulnerability (CNVD-2021-34683)

Ec-cube is an open source e-commerce system of the Japanese company Ec-cube . A cross-site scripting vulnerability exists in EC-CUBE versions 4.0.0 through 4.0.5. The vulnerability stems from a program that allows remote attackers to inject specially crafted script into specific input fields of E...

SQL Injection Vulnerability in Cross-border E-commerce Order System of Hualei Information Technology Co.

Founded in 2013, Hualei Information Technology Co., Ltd. is a professional information technology service provider. A SQL injection vulnerability exists in the cross-border e-commerce order system of Hualei Information Technology Co. An attacker can exploit the vulnerability to obtain sensitive...

Water Pamola Attacked Online Shops Via Malicious Orders

Since 2019, we have been tracking a threat campaign we dubbed as “Water Pamola.” The campaign initially compromised e-commerce online shops in Japan, Australia, and European countries via spam emails with malicious attachments...

Command execution vulnerability in CRMEB Min open source mall (CNVD-2021-34043)

CRMEB brand new a lightweight, high-performance open source e-commerce system . CRMEB Min open source mall there is a command execution vulnerability , an attacker can exploit the vulnerability to obtain server administrative privileges...

Unspecified Vulnerability in Oracle E-Business Suite (CNVD-2021-39950)

Oracle E-Business Suite is an extension of the original Application ERP, including ERP Enterprise Resource Planning, HR Human Resource Management, CRM Customer Relationship Management, and so on, a collection of management software, is a seamless integration of a management suite. oracle iStore i...

Prestashop cross-site scripting vulnerability (CNVD-2021-29732)

Prestashop is a set of open source e-commerce solutions from the United States Prestashop. The solution provides a variety of payment methods , short message alerts and product image scaling and other features . PrestaShop has a security vulnerability , the vulnerability stems from when the grid...