CVE-2022-27435

An unrestricted file upload at /public/admin/index.php?addproduct of Ecommerce-Website v1.1.0 allows attackers to upload a webshell via the Product Image component...

CVE-2022-27435

An unrestricted file upload at /public/admin/index.php?addproduct of Ecommerce-Website v1.1.0 allows attackers to upload a webshell via the Product Image component...

CVE-2022-27436

A cross-site scripting XSS vulnerability in /public/admin/index.php?adduser at Ecommerce-Website v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username text field...

Cross site scripting

A cross-site scripting XSS vulnerability in /public/admin/index.php?adduser at Ecommerce-Website v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username text field...

Unrestricted file upload

An unrestricted file upload at /public/admin/index.php?addproduct of Ecommerce-Website v1.1.0 allows attackers to upload a webshell via the Product Image component...

CVE-2022-27435

An unrestricted file upload at /public/admin/index.php?addproduct of Ecommerce-Website v1.1.0 allows attackers to upload a webshell via the Product Image component...

CVE-2022-27436

A cross-site scripting XSS vulnerability in /public/admin/index.php?adduser at Ecommerce-Website v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username text field...

CVE-2022-27435

The vulnerability CVE-2022-27435 affects Ecommerce-Website v1.1.0, where an unrestricted file upload in the Product Image component at /public/admin/index.php?add_product enables attackers to upload a webshell. The core issue is lack of file upload restrictions in the admin add_product endpoint, ...

CVE-2022-27436

CVE-2022-27436 affects Ecommerce-Website v1.1.0. A cross-site scripting (XSS) vulnerability exists in /public/admin/index.php?add_user that allows arbitrary web scripts or HTML to be executed via a crafted payload in the username field. Root cause appears to be insufficient input sanitization for...

CVE-2022-27436: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in /public/admin/index.php?adduser at Ecommerce-Website v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username text field...

Ecommerce-Website 代码问题漏洞

Ecommerce-Website is a complete e-commerce website with an administration panel built using PHP and MySql. v1.1.0 of Ecommerce-Website is vulnerable to a file upload vulnerability, which stems from a lack of file upload restrictions in public/admin/index.php?addproduct The vulnerability is caused...

CVE-2022-27435: Unrestricted Upload of File with Dangerous Type

An unrestricted file upload at /public/admin/index.php?addproduct of Ecommerce-Website v1.1.0 allows attackers to upload a webshell via the Product Image component...

PT-2022-18426

Name of the Vulnerable Software and Affected Versions Ecommerce-Website version 1.1.0 Description The issue allows attackers to upload a webshell via the Product Image component due to an unrestricted file upload at the "/public/admin/index.php?add product" API endpoint. Recommendations For...

PT-2022-18427

Name of the Vulnerable Software and Affected Versions Ecommerce-Website version 1.1.0 Description A cross-site scripting XSS issue exists in the /public/admin/index.php?add user endpoint, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username...

Ecommerce-Website跨站脚本漏洞

Ecommerce-Website is a complete e-commerce website with an administration panel built using PHP and MySql. version v1.1.0 of Ecommerce-Website contains a cross-site scripting vulnerability that can be exploited by attackers to execute arbitrary Web script or HTML by injecting a payload into the...

Hardware Maker LaCie Admits Yearlong Data Breach

The French computer hardware company LaCie, perhaps best known for their external hard drives, announced this week it fell victim to a data breach that may have put at risk the sensitive information of anyone who has purchased a product off their website during the last year. According to an...

Ecommerce Websites from b1st.com SQL Injection

Ecommerce Websites from b1st.com SQL Injection AUTHOR : S@BUN HOME : http://www.hackturkiye.com MAL : [email protected] DORK 1 : "Ecommerce Websites from b1st.com" DORK 2 : allinurl: EXPLOT WORKNG ON HTML STES LOOK Combo Deals UNDER PAGE YOU WLL SEE ALL USERS USERNAME AND PASSWORD...