Joomla! Component Simple Membership 3.3.3 - 'userId' SQL Injection

Exploit Title: Joomla! Component Simple Membership v3.3.3 - SQL Injection Google Dork: inurl:index.php?option=comsimplemembership Date: 14.03.2017 Vendor Homepage: http://ordasoft.com/ Software :...

Joomla! Component Simple Membership 3.3.3 - userId SQL Injection

Joomla! Component Simple Membership 3.3.3 - userId SQL Injection Exploit Title: Joomla! Component Simple Membership v3.3.3 - SQL Injection Google Dork: inurl:index.php?option=comsimplemembership Date: 14.03.2017 Vendor Homepage: http://ordasoft.com/ Software :...

Joomla Simple Membership 3.3.3 SQL Injection

Exploit Title: Joomla! Component Simple Membership v3.3.3 - SQL Injection Google Dork: inurl:index.php?option=comsimplemembership Date: 14.03.2017 Vendor Homepage: http://ordasoft.com/ Software :...

Hackers with Credit Card Scrapers Continue to Target Magento

Attackers continue to take aim at the e-commerce platform Magento. Researchers said last week they came across a malicious function snuck into one of the platform’s modules in order to steal credit card information. Code for the function was injected into a .php file for SF9 Realex, a module that...

Joomla AltaUserPoints 1.1 Component - userid Parameter SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component AltaUserPoints v1.1 - SQL Injection Google Dork: inurl:index.php?option=comaltauserpoints Date: 04.03.2017 Vendor Homepage: https://www.nordmograph.com/ Software:...

Joomla Coupon 3.5 Component - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component Coupon v3.5 - SQL Injection Google Dork: inurl:index.php?option=comcoupon Date: 03.03.2017 Vendor Homepage: http://joomla6teen.com/ Software:...

Joomla! Component AltaUserPoints 1.1 - 'userid' SQL Injection

Exploit Title: Joomla! Component AltaUserPoints v1.1 - SQL Injection Google Dork: inurl:index.php?option=comaltauserpoints Date: 04.03.2017 Vendor Homepage: https://www.nordmograph.com/ Software: https://extensions.joomla.org/extensions/extension/e-commerce/credits-a-point-systems/altauserpoints/...

Joomla! Component Coupon 3.5 - SQL Injection

Joomla! Component Coupon 3.5 - SQL Injection Exploit Title: Joomla! Component Coupon v3.5 - SQL Injection Google Dork: inurl:index.php?option=comcoupon Date: 03.03.2017 Vendor Homepage: http://joomla6teen.com/ Software:...

Joomla! Component Coupon 3.5 - SQL Injection

Exploit Title: Joomla! Component Coupon v3.5 - SQL Injection Google Dork: inurl:index.php?option=comcoupon Date: 03.03.2017 Vendor Homepage: http://joomla6teen.com/ Software: https://extensions.joomla.org/extensions/extension/e-commerce/gifts-a-coupons/coupon/ Demo:...

Joomla! Component Magic Deals Web 1.2.0 - SQL Injection

Joomla! Component Magic Deals Web 1.2.0 - SQL Injection Exploit Title: Joomla! Component Magic Deals Web v1.2.0 - SQL Injection Google Dork: inurl:index.php?option=commagicdealsweb Date: 21.02.2017 Vendor Homepage: http://jasonwebdesign.com/ Software Buy:...

Cross-Site Request Forgery Vulnerability in TinyShop

TinyShop is an e-commerce system online store system based on the Tiny framework, suitable for businesses and individuals to quickly build a personalized online store. TinyShop is vulnerable to cross-site request forgery. As the program fails to filter user input, an attacker can exploit the...

Tales of WordPress Plugin Insecurity Overblown Researchers Say

The insecurity of WordPress plugins has been well documented, especially over the last year, but in the grand scheme of things, it’s not as bad as it seems, experts claim. Hendrik Buchwald, a researcher and cofounder of RIPS, a German firm that performs static source code analysis, recently combe...

Experts Explain How Hackers Can Hack Your Credit Cards In Seconds

As India attempts an upgrade to a cashless society, cyber security experts have raised serious concerns and revealed how to find credit card information – including expiration dates and CVV numbers – in just 6 Seconds. And what's more interesting? The hack uses nothing more than guesswork by...

TomatoCart 'step_5.php' Cross-Site Scripting Vulnerability

TomatoCart is a set of open source e-commerce software developed using PHP. A cross-site scripting vulnerability exists in TomatoCart 'step5.php'. An attacker can exploit the vulnerability to execute arbitrary script code in an unsuspecting user's browser within the context of the affected site...

WordPress Plugins Leave Online Shoppers Vulnerable

Researchers are calling into question the safety of some of the top WordPress e-commerce plugins used on over 100,000 commercial websites prepping for Black Friday and Cyber Monday online sales. In reviewing the top 12 WordPress e-commerce plugins, application security testing firm Checkmarx foun...

SAP Hybris E-commerce Suite SQL Injection Vulnerability

SAP Hybris Management Console HMC is a suite of enterprise-class multichannel e-commerce and product content management PCM software from SAP. An injection vulnerability exists in SAP Hybris E-commerce Suite that stems from the program failing to adequately filter user-submitted input. An attacke...

EC-CUBE Server-Side Request Forgery Vulnerability

LOCKON EC-CUBE is an open source e-commerce website building platform developed by LOCKON Co. The platform supports product login, user evaluation, artwork layout and so on. A server-side request forgery vulnerability exists in EC-CUBE version 2.12.6en-p1, which can be exploited by remote attacke...

Boozt Fashion AB: Make victim buy in attacker's account without any idea - http://www.booztlet.com/

INTRODUCTION ------------------------ During the testing of http://www.booztlet.com/ I have noticed that the account related links available from https://www.boozt.com/ are also available in http://www.booztlet.com/. This should not be the case, as this shop doesn't have a "My account" section...

SAP Hybris E-commerce Suite Default Credential Validation Bypass Vulnerability

SAP Hybris E-commerce Suite is e-commerce software and multichannel commerce solution. SAP Hybris E-commerce Suite Default Credential Authentication Bypass vulnerability. An attacker could exploit the vulnerability to gain unauthorized access to the affected application...

nopCommerce 3.70 Cross Site Scripting

Security Advisory CVE-ID: N/A Topic: Reflected Cross Site Scripting XSS Vulnerability in "successful registration" page Class: Input Validation Severity: Medium Discovery: 2016-04-28 Vendor Notification: 2016-04-28 Vendor response: 2016-05-30 Vendor Patch: 2016-05-31 Public Announced: 2016-08-15...