Shopware Licensing Issue Vulnerability

Shopware is a suite of open source e-commerce software from the German company Shopware.Shopware suffers from an authorization issue vulnerability that stems from incorrect api routing checks. An attacker could exploit this vulnerability to modify customers and create orders without application...

Shopware Access Control Error Vulnerability

Shopware is a suite of open source e-commerce software from the German company Shopware. Shopware is vulnerable to an access control error that stems from not properly setting sensitive HTTP headers to non-cacheable, which could be exploited by an attacker to enable HTTP caching and then have...

Pimcore Cross-Site Scripting Vulnerability (CNVD-2022-22703)

Pimcore is an open source Web content management platform for creating and managing Web applications from the Austrian company Pimcore. The platform integrates Web content management, e-commerce framework and product information management applications. cross-site scripting vulnerability exists i...

Pimcore Cross-Site Scripting Vulnerability (CNVD-2022-22704)

Pimcore is an open source Web content management platform for creating and managing Web applications from the Austrian company Pimcore. The platform integrates Web content management, e-commerce framework and product information management applications. cross-site scripting vulnerabilities exist ...

WordPress CO2ok: carbon offsetting for e-commerce plugin <= 1.0.9.21 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress CO2ok: carbon offsetting for e-commerce plugin versions = 1.0.9.21. Solution Update the WordPress CO2ok: carbon offsetting for e-commerce plugin to the latest available version at least 1.0.9.22...

Use multiple time the one-time coupon

Description I create a coupon only for one user and a one-time use coupon. Then create two users, and both of them can use the coupon, but only one of them should be able to use the coupon. Proof of Concept first, create a one-time and one-user coupon code that, e.g. is aaaaa. the attacker has tw...

pimcore information leakage vulnerability

Pimcore is an open source Web content management platform for creating and managing Web applications from the Austrian company Pimcore. The platform integrates Web content management, e-commerce frameworks and product information management applications. pimcore suffers from an information...

Critical Magento zero-day vulnerability actively exploiting multiple e-commerce websites

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here Adobe issued an emergency advisory informing Adobe Commerce and Magento Open-Source product users of a critical zero-day vulnerability that is being actively exploited in the wild. A zero-day vulnerability which has been...

S-Cart path traversal vulnerability

S-cart, a Php-based e-commerce management platform from the S-cart community, suffers from a path traversal vulnerability that stems from the failure of a web-based system or product to properly filter special elements in the path of a resource or file. An attacker could exploit the vulnerability...

Adobe: Zero-Day Magento 2 RCE Bug Under Active Attack

A zero-day remote code-execution RCE bug in the Magento 2 and Adobe Commerce platforms has been actively exploited in the wild, Adobe said – prompting an emergency patch to roll out over the weekend. The security vulnerability bug CVE-2022-24086 is a critical affair, allowing pre-authentication R...

Critical Magento 0-Day Vulnerability Under Active Exploitation — Patch Released

Adobe on Sunday rolled out patches to contain a critical security vulnerability impacting its Commerce and Magento Open Source products that it said is being actively exploited in the wild. Tracked as CVE-2022-24086, the shortcoming has a CVSS score of 9.8 out of 10 on the vulnerability scoring...

Pimcore Cross-Site Scripting Vulnerability (CNVD-2022-22706)

Pimcore is an open source Web content management platform for creating and managing Web applications from Pimcore Austria. The platform integrates Web content management, e-commerce frameworks and product information management applications.Pimcore has a cross-site scripting vulnerability that...

WordPress Store Toolkit for WooCommerce plugin cross-site scripting vulnerability

WooCommerce is the world's most popular open source, free and flexible e-commerce plugin for WordPress, and one of the most mature open source e-commerce solutions for building foreign trade malls. cross-site scripting vulnerability exists in versions prior to WordPress Store Toolkit for...

S-cart 路径遍历漏洞

S-cart, a Php-based e-commerce management platform from the S-cart community, suffers from a path traversal vulnerability that stems from the failure of a web-based system or product to properly filter special elements in the path of a resource or file. An attacker could exploit the vulnerability...

Pimcore Cross-Site Scripting Vulnerability (CNVD-2022-22707)

Pimcore is an open source Web content management platform for creating and managing Web applications from Pimcore Austria. The platform integrates Web content management, e-commerce frameworks and product information management applications.Pimcore has a cross-site scripting vulnerability that...

GHSA-MRQ4-7CH7-2465 Server Side Twig Template Injection

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds...

Server Side Twig Template Injection

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds...

CVE-2022-21686

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds...

Code injection

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds...

CVE-2022-21686

CVE-2022-21686 concerns PrestaShop, an open-source e-commerce platform. A vulnerability affects versions 1.7.0.0 through 1.7.8.3 where an attacker can inject Twig code into the back office when using the legacy layout, enabling code injection. The issue is fixed in 1.7.8.3. No public workarounds ...