CVE-2022-31000

The CVE concerns solidus_backend, the admin interface of the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 are affected by a cross-site request forgery (CSRF) that lets an attacker change the state of an order’s adjustments if they know the order number, with the actio...

Microsoft Warns of Web Skimmers Mimicking Google Analytics and Meta Pixel Code

Threat actors behind web skimming campaigns are leveraging malicious JavaScript code that mimics Google Analytics and Meta Pixel scripts in an attempt to sidestep detection. "It's a shift from earlier tactics where attackers conspicuously injected malicious scripts into e-commerce platforms and...

Beneath the surface: Uncovering the shift in web skimming

Microsoft security researchers recently observed that web skimming campaigns now employ various obfuscation techniques to deliver and hide skimming scripts. It’s a shift from earlier tactics where attackers conspicuously injected malicious scripts into e-commerce platforms and content management...

Pimcore Cross-Site Scripting Vulnerability (CNVD-2022-38753)

Pimcore is an open source Web content management platform for creating and managing Web applications from the Austrian company Pimcore. The platform integrates Web content management, e-commerce frameworks and product information management applications. pimcore suffers from a cross-site scriptin...

T-Soft E-Commerce 4 - (UrunAdi) Stored Cross-Site Scripting Vulnerability

Exploit Title: T-Soft E-Commerce 4 - 'UrunAdi' Stored Cross-Site Scripting XSS Exploit Author: Alperen Ergel alpernae IG/TW Web Site: https://alperenae.gitbook.io/ Software Homepage: https://www.tsoft.com.tr/ Version : v4 Tested on: Kali Linux Category: WebApp Google Dork: N/A CVE :N/A Descriptio...

T-Soft E-Commerce 4 Cross Site Scripting

Exploit Title: T-Soft E-Commerce 4 - 'UrunAdi' Stored Cross-Site Scripting XSS Exploit Author: Alperen Ergel alpernae IG/TW Web Site: https://alperenae.gitbook.io/ Software Homepage: https://www.tsoft.com.tr/ Version : v4 Tested on: Kali Linux Category: WebApp Google Dork: N/A Date: 2022-05-10 CV...

T-Soft E-Commerce 4 - 'UrunAdi' Stored Cross-Site Scripting (XSS)

Exploit Title: T-Soft E-Commerce 4 - 'UrunAdi' Stored Cross-Site Scripting XSS Exploit Author: Alperen Ergel alpernae IG/TW Web Site: https://alperenae.gitbook.io/ Software Homepage: https://www.tsoft.com.tr/ Version : v4 Tested on: Kali Linux Category: WebApp Google Dork: N/A Date: 2022-05-10 CV...

T-Soft E-Commerce 4 SQL Injection

Exploit Title: T-Soft E-Commerce 4 - SQLi Authenticated Exploit Author: Alperen Ergel Contact: @alpernae IG/TW Software Homepage: https://www.tsoft.com.tr/ Version : v4 Tested on: Kali Linux Category: WebApp Google Dork: N/A CVE: 2022-28132 Date: 18.02.2022 Description Step-1: Login as Admin or...

ShopWind Cross-Site Scripting Vulnerability

ShopWind is a China ShopWind company based on the Yii2.0 framework deep refactoring of B2B2C, O2O industry e-commerce system software. You can easily create and publish your own brand of professional e-commerce platform for all-round branding and product promotion. shopWind v3.4.2 version and...

E-Commerce Website Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in E-Commerce Website version 1.0, which originates from a cross-site scripting XSS vulnerability in /public/admin/index.php?addproduct that allows an attacker to inject a specially crafted payload into the product title text field by injecting speciall...

s-cart Cross-Site Scripting Vulnerability (CNVD-2022-70091)

s-cart is a Php-based e-commerce management platform from the s-cart community. s-cart versions prior to 6.9 contain a cross-site scripting vulnerability that can be exploited by attackers to execute JavaScript code on the client side, which can steal cookies from any victim who accesses the...

Shopizer Cross-Site Scripting Vulnerability (CNVD-2022-70092)

Shopizer is a Java-based e-commerce solution from the Shopizer team. 2.0 to 2.17.0 versions of Shopizer are vulnerable to a cross-site scripting vulnerability in which the file name under the "Manage Files" tab lacks validation filters for user-supplied and output data. An attacker could use this...

Shopware Cross-Site Scripting Vulnerability (CNVD-2022-47472)

Shopware is a suite of open source e-commerce software from the German company Shopware. cross-site scripting vulnerability exists in versions of Shopware prior to 5.7.9, which stems from a lack of filtering and escaping of user data in the plugin. No detailed vulnerability details are available...

CVE-2022-27330

A cross-site scripting XSS vulnerability in /public/admin/index.php?addproduct of E-Commerce Website v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Title text field...

CVE-2022-27330

A cross-site scripting XSS vulnerability in /public/admin/index.php?addproduct of E-Commerce Website v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Title text field...

CVE-2022-27330

A cross-site scripting XSS vulnerability in /public/admin/index.php?addproduct of E-Commerce Website v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Title text field...

Cross site scripting

A cross-site scripting XSS vulnerability in /public/admin/index.php?addproduct of E-Commerce Website v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Title text field...

CVE-2022-27330

CVE-2022-27330 describes a cross-site scripting (XSS) vulnerability in the E-Commerce Website v1.0, exploitable through a crafted payload injected into the Product Title field when using the admin URL /public/admin/index.php?add_product. The vulnerability allows execution of arbitrary web scripts...

CVE-2022-27330

A cross-site scripting XSS vulnerability in /public/admin/index.php?addproduct of E-Commerce Website v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Title text field...

GHSA-7PFC-CX3M-V22X SCart is vulnerable to cross-site scripting (XSS)

SCart e-commerce is a free open source for businesses, built on the Laravel framework. The package s-cart/s-cart before 6.9 and the package s-cart/core before 6.9 are vulnerable to cross-site Scripting XSS which can lead to cookie stealing of any victim that visits the affected URL. An attacker c...