Joomla! Component ECommerce-WD 1.2.5 - SQL Injection

Joomla! Component ECommerce-WD 1.2.5 - SQL Injection Version 1.2.5 of the ECommerce-WD plugin for Joomla! has multiple unauthenticated SQL injections available via the advanced search functionality. http://extensions.joomla.org/extension/ecommerce-wd The vulnerable parameters are searchcategoryid...

Joomla! Component ECommerce-WD 1.2.5 - SQL Injection

Version 1.2.5 of the ECommerce-WD plugin for Joomla! has multiple unauthenticated SQL injections available via the advanced search functionality. http://extensions.joomla.org/extension/ecommerce-wd The vulnerable parameters are searchcategoryid, sortorder, and filtermanufacturerids within the...

Joomla ECommerce-WD 1.2.5 SQL Injection

Version 1.2.5 of the ECommerce-WD plugin for Joomla! has multiple unauthenticated SQL injections available via the advanced search functionality. http://extensions.joomla.org/extension/ecommerce-wd The vulnerable parameters are searchcategoryid, sortorder, and filtermanufacturerids within the...

Yahoo Patches Critical Small Business, eCommerce Bugs

Yahoo has fixed a handful of vulnerabilities that could have given an attacker free reign over all of its user-run eCommerce websites and caused multiple headaches for small business owners. One bug could have allowed a hacker to change item prices on a whim and given them access to sensitive...

Wpshop - eCommerce <= 1.3.9.5 - Arbitrary File Upload

The script 'includes/ajax.php' allows execution of various actions by anonymous users. The action name is provided in the 'elementCode' parameter. One of these actions is named 'ajaxUpload'. This function allows for upload of arbitrary files, due to lack of sanitation of user input...

Zeuscart 4 Cross Site Scripting / SQL Injection

Advisory: Multiple reflecting XSS-, SQLi and InformationDisclosure-vulnerabilities in Zeuscart v.4 Advisory ID: SROEADV-2015-12 Author: Steffen Rösemann Affected Software: Zeuscart v.4 Vendor URL: http://zeuscart.com/ Vendor Status: pending CVE-ID: will asked to be assigned after release on...

Zeuscart 4.0 - Multiple Vulnerabilities

Advisory: Multiple reflecting XSS-, SQLi and InformationDisclosure-vulnerabilities in Zeuscart v.4 Advisory ID: SROEADV-2015-12 Author: Steffen Rösemann Affected Software: Zeuscart v.4 Vendor URL: http://zeuscart.com/ Vendor Status: pending CVE-ID: will asked to be assigned after release on...

Zeuscart v.4 - Multiple Vulnerabilities

Exploit for php platform in category web applications Advisory: Multiple reflecting XSS-, SQLi and InformationDisclosure-vulnerabilities in Zeuscart v.4 Author: Steffen Rösemann Affected Software: Zeuscart v.4 Vendor URL: http://zeuscart.com/ Vendor Status: pending CVE-ID: will asked to be assign...

WP eCommerce 3.8.9.5 - Cross-Site Scripting (XSS)

The WP eCommerce WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

WordPress Cart66 Lite 1.5.4 Cross Site Scripting

Title: WordPress 'Cart66 Lite :: WordPress Ecommerce' plugin - Reflected XSS Version: 1.5.4 Author: Morten Nørtoft, Kenneth Jepsen, Mikkel Vej Date: 2015/01/26 Download: https://wordpress.org/plugins/cart66-lite/ Contacted WordPress: 2015/01/26...

Magento eCommerce Web Sites Authentication Bypass (CVE-2015-1398)

An authentication bypass vulnerability was reported in Magento component. The vulnerability is due to a user controlled parameter affecting the login mechanism. A remote attacker can exploit this issue by sending a specially crafted HTTP request to a vulnerable system. Successful exploitation may...

Magento eCommerce Web Sites SQL Injection (CVE-2015-1397)

An SQL injection vulnerability has been reported in Magento component. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

Magento eCommerce Web Sites Remote File Inclusion (CVE-2015-1399)

A remote file inclusion vulnerability has been reported in Magento component. The vulnerability is due to lack of sanitization for user-supplied data. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

CVE-2015-1175-xss-prestashop

CVE-2015-1175-xss-prestashop Information ——————– Advisory by Octogence. Name: Reflected XSS Vulnerability in prestashop ecommerce software Affected Software : Prestashop Affected Versions: 1.6.0.9 and possibly below Vendor Homepage : https://www.prestashop.com/ Vulnerability Type : Cross-site...

Prestashop 1.6.0.9 Cross Site Scripting

CVE-2015-1175-xss-prestashop Information ——————– Advisory by Octogence. Name: Reflected XSS Vulnerability in prestashop ecommerce software Affected Software : Prestashop Affected Versions: 1.6.0.9 and possibly below Vendor Homepage : https://www.prestashop.com/ Vulnerability Type : Cross-site...

CosmoShop ePRO Cross-Site Request Forgery Vulnerability

CosmoShop ePRO is a cloud e-commerce system based on Magento. The system is able to quickly complete domain name setup, online store installation, server deployment and product launch. A cross-site request forgery vulnerability exists in CosmoShop ePRO 10.05.00, which allows remote attackers to...

Multiple Cross-Site Scripting Vulnerabilities in CosmoShop ePRO

CosmoShop ePRO is a cloud e-commerce system based on Magento. The system is able to quickly complete domain name setup, online store installation, server deployment and product launch. CosmoShop ePRO suffers from multiple cross-site scripting vulnerabilities that can be exploited by remote...

Cart66 Lite WordPress Ecommerce 1.5.1.17 SQL Injection

Exploit Title: Cart66 Lite WordPress Ecommerce 1.5.1.17 Blind SQL Injection Date: 29-10-2014 Exploit Author: Kacper Szurek - http://security.szurek.pl/ http://twitter.com/KacperSzurek Software Link: https://downloads.wordpress.org/plugin/cart66-lite.1.5.1.17.zip Category: webapps 1. Description...

Cart66 Lite WordPress Ecommerce 1.5.1.17 Blind SQL Injection

Exploit for php platform in category web applications Exploit Title: Cart66 Lite WordPress Ecommerce 1.5.1.17 Blind SQL Injection Date: 29-10-2014 Exploit Author: Kacper Szurek - http://security.szurek.pl/ http://twitter.com/KacperSzurek Software Link:...

WordPress Plugin Cart66 Lite eCommerce 1.5.1.17 - Blind SQL Injection

Exploit Title: Cart66 Lite WordPress Ecommerce 1.5.1.17 Blind SQL Injection Date: 29-10-2014 Exploit Author: Kacper Szurek - http://security.szurek.pl/ http://twitter.com/KacperSzurek Software Link: https://downloads.wordpress.org/plugin/cart66-lite.1.5.1.17.zip Category: webapps 1. Description...