CVE-2024-42355

Shopware, an open ecommerce platform, has a new Twig Tag swsilentfeaturecall which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and...

CVE-2024-13205

A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/createproduct.php of the component Create Product Page. The manipulation of the argument Name leads to cross site scripting. Th...

CVE-2024-42355 Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag

Shopware, an open ecommerce platform, has a new Twig Tag swsilentfeaturecall which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and...

CVE-2024-42355 Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag

Shopware, an open ecommerce platform, has a new Twig Tag swsilentfeaturecall which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and...

kirilkirkov Ecommerce-Laravel-Bootstrap 代码问题漏洞

kirilkirkov Ecommerce-Laravel-Bootstrap is a responsive, multi-vendor, multi-language online store platform shopping cart solution kirilkirkov Ecommerce-Laravel-Bootstrap suffers from a code issue vulnerability that stems from the fact that manipulation of the parameter laraCart can lead to...

CVE-2024-34349 Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel

Sylius is an open source eCommerce platform. Prior to 1.12.16 and 1.13.1, there is a possibility to execute javascript code in the Admin panel. In order to perform an XSS attack input a script into Name field in which of the resources: Taxons, Products, Product Options or Product Variants. The co...

Ecommerce-CodeIgniter-Bootstrap 安全漏洞

Ecommerce-CodeIgniter-Bootstrap is a responsive, multi-vendor, multi-language online store platform shopping cart solution. A security vulnerability exists in Ecommerce-CodeIgniter-Bootstrap that stems from an arbitrary code execution vulnerability in the manageQuantitiesAndProcurement method of...

Ecommerce-CodeIgniter-Bootstrap 安全漏洞

Ecommerce-CodeIgniter-Bootstrap is a responsive, multi-vendor, multi-language online store platform shopping cart solution. A security vulnerability exists in Ecommerce-CodeIgniter-Bootstrap, which stems from an arbitrary code execution vulnerability in the getLangFolderForEdit method of the...

NIUSHOP Security Vulnerabilities

Niushop NIUSHOP is an open source e-commerce system from China's Niukoo Information Technology Niushop. NIUSHOP B2B2C V5 version has a security vulnerability , the vulnerability stems from the unrestricted upload...

Kshitish 2.0 Default Credentials

==================================================================================================================================== | Title : kshitish v2.0 Multipurpose eCommerce Platform Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser :...

SAP Commerce跨站脚本漏洞

SAP Commerce is a set of cloud-based e-commerce platform from Germany's SAP. It supports sales management, marketing management, order management and operations management. A cross-site scripting vulnerability exists in several versions of SAP Commerce Webservices 2.0, which stems from a lack of...

Ecommerce-CodeIgniter-Bootstrap 跨站脚本漏洞

Ecommerce-CodeIgniter-Bootstrap is a responsive, multi-vendor, multi-language online store platform shopping cart solution. A security vulnerability exists in versions of Ecommerce-CodeIgniter-Bootstrap prior to 56465f, which stems from the function baseurl in blog/blogpublish.php was found to...

Cross site scripting

Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting XSS code in the admin panel. In order to perform a XSS attack, the file itself has to be open in a new card or loaded outside of the...

Default credentials

Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and unauthorized password change. The issue ...

CVE-2022-24742 Exposure of Sensitive Information Due to Incompatible Policies in Sylius

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. The application must strictly redirect...

CVE-2022-24742 Exposure of Sensitive Information Due to Incompatible Policies in Sylius

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. The application must strictly redirect...

CVE-2022-24733

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface wi...

CVE-2022-24733 Improper Restriction of Rendered UI Layers or Frames in Sylius

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface wi...

CVE-2022-24733 Improper Restriction of Rendered UI Layers or Frames in Sylius

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface wi...

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting XSS code in the admin panel. In order to perform a XSS attack, the file itself has to be open in a new card or loaded outside of the...