CVE-2025-2035

CVE-2025-2035 affects s-a-zhd Ecommerce-Website-using-PHP 1.0. The vulnerability is in /customer_register.php where manipulation of the argument name enables unrestricted upload. The issue can be exploited remotely, and the exploit has been disclosed publicly. No remediation details are provided ...

Ecommerce-Website 注入漏洞

Ecommerce-Website is a complete e-commerce website with an administration panel built using PHP and MySql. An injection vulnerability exists in Ecommerce-Website version 1.0, which stems from an incorrect operation of the parameter proid that can lead to SQL injection...

zz 代码问题漏洞

zz is an e-commerce platform for zj1983 individual developers. A security vulnerability exists in zz 2024-8 and earlier versions, which stems from a server-side request forgery in the importdatacheck file...

zz 代码问题漏洞

zz is an e-commerce platform for zj1983 individual developers. A security vulnerability exists in zz 2024-8 and earlier versions, which stems from a server-side request forgery in the importdatatodb file...

zz 注入漏洞

zz is an e-commerce platform by the individual developer of zj1983. An injection vulnerability exists in zj1983 zz 2024-8 and prior versions, which stems from SQL injection and could lead to remote code execution...

eCommerce Customer Service Tips For Online Support: The Basics

Strong eCommerce customer service builds trust, boosts loyalty, and drives sales. Learn key strategies, best practices, and tools to enhance online support...

PT-2025-7713

Name of the Vulnerable Software and Affected Versions T-Soft E-Commerce versions prior to 5 Description The issue affects T-Soft E-Commerce, allowing Cross-Site Scripting XSS due to improper neutralization of input during web page generation. Recommendations For versions prior to 5, update to...

PT-2025-6601 · WordPress · The Flexible Wishlist For Woocommerce

Name of the Vulnerable Software and Affected Versions: Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress versions up to, and including, 1.2.26 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on...

CVE-2021-37710

Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a Cross-Site Scripting vulnerability via SVG media files. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin...

CVE-2022-24743

Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and unauthorized password change. The issue ...

CVE-2022-2432

The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.10.23. This is due to missing or incorrect nonce validation on the ecwidupdatepluginparams function. This makes it possible for unauthenticated attackers to updat...

CVE-2024-56023

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PerfectSolution WP eCommerce Quickpay wp-ecommerce-quickpay allows Reflected XSS.This issue affects WP eCommerce Quickpay: from n/a through = 1.1.0...

CVE-2024-32558

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in impleCode eCommerce Product Catalog allows Reflected XSS.This issue affects eCommerce Product Catalog: from n/a through 3.3.32...

CVE-2024-54412

Cross-Site Request Forgery CSRF vulnerability in etemplates ECT Product Carousel ect-product-carousel allows Stored XSS.This issue affects ECT Product Carousel: from n/a through = 1.9...

CVE-2024-42355

Shopware, an open ecommerce platform, has a new Twig Tag swsilentfeaturecall which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and...

WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2411060 - Missing Authorization to Authenticated (Subscriber+) Log Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Log Deletion vulnerability discovered by incognito in WordPress Plugin ECPay Ecommerce for WooCommerce versions = 1.1.2411060...

CVE-2024-13652

The ECPay Ecommerce for WooCommerce plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'clearecpaydebuglog' AJAX action in all versions up to, and including, 1.1.2411060. This makes it possible for authenticated attackers, with Subscriber-leve...

CVE-2024-13652 ECPay Ecommerce for WooCommerce <= 1.1.2411060 - Missing Authorization to Authenticated (Subscriber+) Log Deletion

The ECPay Ecommerce for WooCommerce plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'clearecpaydebuglog' AJAX action in all versions up to, and including, 1.1.2411060. This makes it possible for authenticated attackers, with Subscriber-leve...

CVE-2024-13652

Summary: CVE-2024-13652 affects the WordPress plugin ECPay Ecommerce for WooCommerce, version range up to and including 1.1.2411060. The vulnerability arises from a missing capability check on the AJAX action clear_ecpay_debug_log, enabling authenticated users with Subscriber-level access or high...

CVE-2024-13652 ECPay Ecommerce for WooCommerce <= 1.1.2411060 - Missing Authorization to Authenticated (Subscriber+) Log Deletion

The ECPay Ecommerce for WooCommerce plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'clearecpaydebuglog' AJAX action in all versions up to, and including, 1.1.2411060. This makes it possible for authenticated attackers, with Subscriber-leve...