CVE-2020-23975

CVE-2020-23975 affects Webexcels Ecommerce CMS 2.x (2017–2020). The vulnerability is a cross-site scripting flaw exploitable via the id parameter in search.php. No detailed exploit vectors or patch information are provided in the connected documents; remediation details are not stated. In summary...

Ltd. Ebuycms has a flaw in the logic of unification vulnerability

Ebuycms is an e-commerce mall platform system developed for a wide range of small and medium-sized enterprises. Ltd. Ebuycms has a statistical logic flaw vulnerability that can be exploited by attackers to repeatedly obtain coupons...

SQL Injection Vulnerability in EbuyCMS of Hainan Eju Technology Co.

Ebuycm is a professional-grade e-commerce mall platform system developed for small and medium-sized enterprises. A SQL injection vulnerability exists in EbuyCMS of Hainan E&U Technology Co. An attacker can exploit the vulnerability to obtain sensitive database information...

Travel Management System 1.0 Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: Travel Management System v1.0 - Unauthenticated Remote Code Execution Exploit Author: Adeeb Shah @hyd3sec & Bobby Cooke boku Vulnerability Discovery: Adeeb Shah @hyd3sec Date: August 10, 2020 Vendor Homepage:...

Solidus Input Validation Error Vulnerability

Solidus is an open source e-commerce system. An input validation error vulnerability exists in Solidus versions prior to 2.8.6, prior to 2.9.6, and prior to 2.10.2. The vulnerability stems from a network system or product that does not properly validate incoming data. No detailed vulnerability...

Arbitrary Code Execution Vulnerability in Verydows Backend

Verydows is a completely free and open source e-commerce management system developed using PHP, featuring cross-platform, lightweight, high performance, high load and security stability. Verydows backend arbitrary code execution vulnerabilities, attackers can exploit the vulnerability to obtain...

File Upload Vulnerability in Verydows 2.0 Backend

Verydows is a free and open source e-commerce management system developed using PHP, featuring cross-platform, lightweight, high performance and strong security. Verydows 2.0 backend file upload vulnerability, attackers can exploit the vulnerability to obtain server privileges...

SQL Injection Vulnerability in 5vshop E-commerce System of Shijiazhuang Zhenhong Network Technology Co.

5vshop belongs to Shijiazhuang Zhenghong Network Technology Co., Ltd, since 2004 has been committed to the enterprise Internet application of related services, engaged in enterprise, personal e-commerce website construction; e-commerce project planning, creativity, operation, to provide a...

OurPHP website builder system suffers from an arbitrary file read vulnerability.

OurPHP Aopia website building system is a enterprise + e-commerce marketing website building system. OurPHP website builder system has an arbitrary file reading vulnerability, which can be exploited by attackers to read arbitrary system files...

CVE-2020-13923

IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04...

CVE-2020-13923

IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04...

Security feature bypass

IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04...

CVE-2020-13923

CVE-2020-13923 is an IDOR vulnerability in the order processing feature of the ERP/commerce component of Apache OFBiz, affecting versions prior to 17.12.04. The connected CNVD entry characterizes the issue as an input validation error that enables bypassing security restrictions and direct access...

CVE-2020-13923

IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04...

Claire's Customers Targeted with Magecart Payment-Card Skimmer

A Magecart credit-card skimmer was used to attack online customers of the retailer Claire’s for a month and a half, according to researchers. Claire’s – a purveyor of jewelry and accessories – closed its 3,000 physical retail locations worldwide on March 20, in the wake of the COVID-19 pandemic. ...

SAP Commerce Information Disclosure Vulnerability

SAP Commerce is a set of cloud-based e-commerce platform from Germany's SAP. This product supports sales management, marketing management, order management and operations management. An information disclosure vulnerability exists in SAP Commerce. An attacker could exploit this vulnerability to...

ebcwebstore.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1179281 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2020-020

Drupal Commerce is used to build eCommerce websites and applications. It's possible to configure commerce to permit orders by anonymous users. In this configuration, customers who do not choose to create an account upon checkout completion remain anonymous, and the resulting orders are never...

Sellacious eCommerce Shop Cross Site Scripting

Document Title: =============== Sellacious eCommerce - Multiple Persistent Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2226 Release Date: ============= 2020-05-08 Vulnerability Laboratory ID VL-ID: ===================================...

Sellacious eCommerce 4.6 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Sellacious eCommerce 4.6 - Persistent Cross-Site Scripting Exploit Author: gurbanli Vendor Homepage: https://www.sellacious.com Version: 4.6 Software Link: https://www.sellacious.com/free-open-source-ecommerce-software Document...