CVE-2021-32709 Creation of order credits was not validated by acl in admin orders

Shopware is an open source eCommerce platform. Creation of order credits was not validated by ACL in admin orders. Users are recommend to update to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versio...

CVE-2021-32709

Shopware CVE-2021-32709 relates to the admin orders workflow where creation of order credits was not validated by ACL. The root cause is missing ACL validation for credit creation in admin orders, enabling potential unauthorized actions. A fix is available: update to Shopware 6.4.1.1, obtainable ...

CVE-2021-32711: Exposure of Sensitive Information to an Unauthorized Actor

Shopware is an open source eCommerce platform. Versions prior to 6.3.5.1 may leak of information via Store-API. The vulnerability could only be fixed by changing the API system, which involves a non-backward-compatible change. Only consumers of the Store-API should be affected by this change. We...

CVE-2021-32710: Session Fixation

Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview. For older version...

Zhongbang CRMEB 代码问题漏洞

Zhongbang CRMEB is an open source e-commerce management system from Zhongbang Networks Zhongbang in Xi'an, China. A security vulnerability exists in CRMEB 3.1.0+, which stems from the strict domain name filtering in CRMEB 3.1.0+ leading to SSRF Server Side Request Forgery. No detailed vulnerabili...

CVE-2021-24293

In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call getcartitems via photocratiajax , after that the settingsshippingaddressname is able to inject malicious javascript...

CVE-2021-24293

In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call getcartitems via photocratiajax , after that the settingsshippingaddressname is able to inject malicious javascript...

Code injection

In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call getcartitems via photocratiajax , after that the settingsshippingaddressname is able to inject malicious javascript...

CVE-2021-24293

The CVE-2021-24293 entry concerns the NextGEN Gallery Pro WordPress plugin (before 3.1.11). The vulnerability occurs in the eCommerce module: an action invokes photocrati_ajax to call get_cart_items, after which settings[shipping_address][name] can be manipulated to inject malicious JavaScript. D...

CVE-2021-24293 NextGEN Gallery Pro < 3.1.11 - Reflected Cross-Site Scripting (XSS)

In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call getcartitems via photocratiajax , after that the settingsshippingaddressname is able to inject malicious javascript...

CVE-2021-24293: Improper Neutralization of Input During Web Page Generation

In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call getcartitems via photocratiajax , after that the settingsshippingaddressname is able to inject malicious javascript...

PT-2021-15832

Name of the Vulnerable Software and Affected Versions NextGEN Gallery Pro WordPress plugin versions prior to 3.1.11 Description The issue concerns the eCommerce module of the NextGEN Gallery Pro WordPress plugin. It involves an action that calls get cart items via photocrati ajax, allowing the...

WordPress NextGEN Gallery 跨站脚本漏洞

WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.NextGEN Gallery is an image gallery plugin used in it. WordPress plugin NextGEN Gallery Pro before 3.1.11 version has a...

NextGEN Gallery Pro < 3.1.11 - Reflected Cross-Site Scripting (XSS)

In the eCommerce module of NextGEN Gallery Pro, there is an action to call getcartitems via photocratiajax , after that the settingsshippingaddressname is able to inject malicious javascript. PoC On a page where a NextGEN Pro gallery is embed:...

eCommerce Product Catalog < 3.0.18 - CSRF Nonce Bypass

The plugin did not properly check the CSRF nonce in the icorders.save function, which could allow attackers to make a logged in user with the editdigitalorder capability save arbitrary digital orders...

WordPress eCommerce Product Catalog plugin <= 3.0.17 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found in WordPress eCommerce Product Catalog plugin versions = 3.0.17. Solution Update the WordPress eCommerce Product Catalog plugin to the latest available version at least 3.0.18...

Adobe Magento 操作系统命令注入漏洞

Adobe Magento is Adobe's one with PHP written in open source e-commerce platform.Magento Community Edition is the community edition, later renamed Magento Open Source, Magento Enterprise Edition is the enterprise edition, later renamed Magento Magento Enterprise Edition is the enterprise edition,...

Code Execution Vulnerability in the Backend of Ecommerce Power Mall System of Shenzhen Yitongding Multimedia Co.

The business scope of Shenzhen ETD Multimedia Co., Ltd. includes: website construction, mobile WeChat mini-program development, mini-program community group-buying system, VI design, network operation, cloud products-operation and maintenance solutions. There is a code execution vulnerability in...

Simplcommerce 跨站脚本漏洞

Simplcommerce is Simplcommerce individual developers of a .Net-based e-commerce platform. SimplCommerce 1.0.0-rc suffers from a cross-site scripting vulnerability in which the Bootbox.js library does not perform any cleanup operations on user input. No details of the vulnerability are provided at...

HCL Commerce 安全漏洞

HCL Commerce is a software platform framework for e-commerce from HCL India. The software includes marketing, sales, customer and order processing functionality in a customizable and integrated package. It is a unified platform that provides the ability to conduct business directly with consumers...