Design/Logic Flaw

The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks...

CVE-2023-1124 Shopping Cart & eCommerce Store < 5.4.3 - Admin+ LFI

The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks...

CVE-2023-1124

CVE-2023-1124 affects the Shopping Cart & eCommerce Store WordPress plugin (versions before 5.4.3). The vulnerability arises from not validating HTTP requests, allowing authenticated administrators to perform Local File Inclusion (LFI) attacks. Impact is high for confidentiality, integrity, and a...

WordPress plugin Shopping Cart & eCommerce Store 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A path traversal vulnerability exists in th...

AmazCart CMS 3.4 - Cross-Site-Scripting Vulnerability

Exploit Title: AmazCart CMS 3.4 - Cross-Site-Scripting XSS Exploit Author: Sajibe Kanti Vendor Name: CodeThemes Vendor Homepage: https://spondonit.com/ Software Link: https://codecanyon.net/item/amazcart-laravel-ecommerce-system-cms/34962179 Version: 3.4 Tested on: Live Demo Demo Link :...

CVE-2022-47444 WordPress ProfilePress Plugin <= 4.4.1 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin = 4.5.3 versions...

CVE-2022-47444

The CVE-2022-47444 entry concerns an Unauth. Reflected Cross-Site Scripting (XSS) in the ProfilePress Membership Team Paid Membership Plugin. Affected are ProfilePress plugin versions

PT-2023-15320 · WordPress · Profilepress

Name of the Vulnerable Software and Affected Versions: ProfilePress plugin versions = 4.5.3 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability in the ProfilePress Membership Team Paid Membership Plugin. This affects components such as Ecommerce, Registration For...

CVE-2023-27638

An issue was discovered in the tshirtecommerce aka Custom Product Designer component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised tshirtecommercedesigncartid GET parameter in order to exploit an insecure parameter in the functions hookActionCartSave and...

CVE-2023-1557

A vulnerability was found in SourceCodester E-Commerce System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /ecommerce/admin/user/controller.php?action=edit of the component Username Handler. The manipulation of the argument USERID leads to...

PT-2023-21273 · Prestashop · Tshirtecommerce

Name of the Vulnerable Software and Affected Versions: tshirtecommerce aka Custom Product Designer component version 2.1.4 for PrestaShop Description: An issue was discovered in the tshirtecommerce component, where an HTTP request can be forged with a compromised tshirtecommerce design cart id GE...

PT-2023-17073 · Sourcecodester · Sourcecodester E-Commerce System

Name of the Vulnerable Software and Affected Versions: SourceCodester E-Commerce System version 1.0 Description: A critical issue affects some unknown functionality of the file /ecommerce/admin/user/controller.php?action=edit of the component Username Handler. The manipulation of the USERID...

CVE-2023-1507

A vulnerability has been found in SourceCodester E-Commerce System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /ecommerce/admin/category/controller.php of the component Category Name Handler. The manipulation of the argument CATEGORY...

CVE-2023-1506

A vulnerability, which was classified as critical, was found in SourceCodester E-Commerce System 1.0. Affected is an unknown function of the file login.php. The manipulation of the argument UUSERNAME leads to sql injection. It is possible to launch the attack remotely. The complexity of an attack...

CVE-2023-1504

A vulnerability classified as critical was found in SourceCodester Alphaware Simple E-Commerce System 1.0. This vulnerability affects unknown code. The manipulation of the argument email/password with the input test1%40test.com ' AND SELECT 6077 FROM SELECTSLEEP5dltn AND 'PhRa'='PhRa leads to sql...

PT-2023-2219 · Sourcecodester · Sourcecodester E-Commerce System

Name of the Vulnerable Software and Affected Versions: SourceCodester E-Commerce System version 1.0 Description: A critical issue has been found in the processing of the file /ecommerce/admin/settings/setDiscount.php, which is related to a lack of protection of the SQL query structure. This issue...

PT-2023-17038 · Sourcecodester · Sourcecodester Alphaware Simple E-Commerce System

Name of the Vulnerable Software and Affected Versions: SourceCodester Alphaware Simple E-Commerce System version 1.0 Description: A critical issue affects some unknown functionality of the file function/edit customer.php. The manipulation of the argument firstname/mi/lastname with the input a'...

WordPress eCommerce Product Catalog Plugin <= 3.3.8 is vulnerable to Cross Site Scripting (XSS)

Software eCommerce Product Catalog Type Plugin Vulnerable versions = 3.3.8 Fixed in 3.3.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1470 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b594574ee607 Credits Marco Wotschka...

E-Commerce System SQL注入漏洞

Moosikay E-Commerce System is an e-commerce system by the individual developer Arvin Arandilla. A SQL injection vulnerability exists in E-Commerce System version 1.0, which stems from an incorrect manipulation of the parameter id resulting in sql injection...

CVE-2023-1470

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...