PT-2024-14926 · WordPress · Ecwid Ecommerce Shopping Cart

Name of the Vulnerable Software and Affected Versions: Ecwid Ecommerce Shopping Cart WordPress plugin versions prior to 6.12.5 Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...

Spoofing

ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. Access control and permissions are not being enforced. This vulnerability has been patched in...

CVE-2024-21665 Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list

ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. Access control and permissions are not being enforced. This vulnerability has been patched in...

CVE-2024-21665

CVE-2024-21665 affects Pimcore’s ecommerce-framework-bundle. An authenticated user without proper permissions can access the back-office orders list via the admin/ecommerceframework/admin-order/list endpoint, indicating insufficient access control. Root cause: lack of permission enforcement for t...

CVE-2024-21665 Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list

ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. Access control and permissions are not being enforced. This vulnerability has been patched in...

CVE-2024-21665 Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list

ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. Access control and permissions are not being enforced. This vulnerability has been patched in...

Pimcore Security Vulnerability

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, ecommerce framework and product information management applications. A security vulnerability exists in Pimcore...

GHSA-CX99-25HR-5JXF Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list

Summary An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. Details Permissions do not seem to be enforced when reaching the admin/ecommerceframework/admin-order/list endpoint allowing an authenticated user without the...

Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list

Summary An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. Details Permissions do not seem to be enforced when reaching the admin/ecommerceframework/admin-order/list endpoint allowing an authenticated user without the...

PT-2024-19007 · Pimcore · Pimcore Ecommerce Framework Bundle

Name of the Vulnerable Software and Affected Versions: Pimcore Ecommerce Framework Bundle versions prior to 1.0.10 Description: The issue allows an authenticated and unauthorized user to access the back-office orders list and query over the information returned due to a lack of enforced access...

eCommerce Product Catalog < 3.3.27 - Sensitive Information Exposure via CSV Files

Description The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to 3.3.27 exclusive via import and export CSV files. This makes it possible for unauthenticated attackers to extract sensitive data including full...

CVE-2023-51688

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress.This issue affects eCommerce Product Catalog Plugin for WordPress: from n/a through 3.3.26...

CVE-2023-4674

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Yaztek Software Technologies and Computer Systems E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: through 20231229. NOTE: The vendor was contacted early about this...

CVE-2023-51688

CVE-2023-51688 affects the eCommerce Product Catalog Plugin for WordPress by impleCode. The vulnerability is described as Exposure of Sensitive Information to an Unauthorized Actor, specifically via CSV file exposure for versions up to 3.3.26. Wordfence indicates the issue is real and has a patch...

CVE-2023-51688 WordPress eCommerce Product Catalog Plugin <= 3.3.26 is vulnerable to Sensitive Data Exposure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress.This issue affects eCommerce Product Catalog Plugin for WordPress: from n/a through 3.3.26...

WordPress Plugin eCommerce Product Catalog Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...

E-Commerce Site Cross-Site Scripting Vulnerability

E-Commerce Site is an e-commerce website. A cross-site scripting vulnerability exists in E-Commerce Site. No information about this vulnerability is available at this time, please stay tuned to CNNVD or vendor announcements...

WordPress eCommerce Product Catalog Plugin <= 3.3.26 is vulnerable to Sensitive Data Exposure

Software eCommerce Product Catalog Type Plugin Vulnerable versions = 3.3.26 Fixed in 3.3.27 OWASP Top 10 A4: Insecure Design Classification Sensitive Data Exposure CVE CVE-2023-51688 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID d7f671a2c15c Credits Muhammad Daffa Requir...

PT-2023-32876 · Unknown · Code-Projects E-Commerce Website

Name of the Vulnerable Software and Affected Versions: code-projects E-Commerce Website version 1.0 Description: A critical issue was found in the code-projects E-Commerce Website, affecting an unknown functionality of the file product details.php. The manipulation of the prod id argument leads t...

The vulnerability of the Welcart eCommerce plugin for the WordPress content management system allows a hacker to execute arbitrary code.

The vulnerability of the Welcart eCommerce plugin for the WordPress content management system is related to an incorrect restriction on the path to the restricted access catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...