WordPress WP-Ecommerce-Shop-Styling 2.5 File Download

Title: Remote file download vulnerability in wordpress plugin wp-ecommerce-shop-styling v2.5 Author: Larry W. Cashdollar, @larry0 Date: 2015-07-05 Download Site: https://wordpress.org/plugins/wp-ecommerce-shop-styling Vendor: https://profiles.wordpress.org/haet/ Vendor Notified: 2015-07-05, fixed...

yhst-94582326164583.ecommerce-site-search.com XSS vulnerability

Vulnerable URL: http://yhst-94582326164583.ecommerce-site-search.com/?page=1=ch0a"BoDY Details: Description| Value ---|--- Patched:| Yes, at 22.11.2017 Latest check for patch:| 22.11.2017 08:59 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

WordPress Plugin TheCartPress eCommerce Shopping Cart Cross-Site Request Forgery Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports setting up personal blog sites on servers with PHP and MySQL.TheCartPress eCommerce Shopping Cart plugin for WordPress is an eCommerce shopping cart plugin for WordPress based ...

CVE-2015-3301

Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. dot dot in the tcpboxpath parameter in the checkouteditorsettings page to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allow remote attackers to inject arbitrary web script or HTML via the 1 billingfirstname, 2 billinglastname, 3...

Directory traversal

Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. dot dot in the tcpboxpath parameter in the checkouteditorsettings page to...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allows remote attackers to hijack the authentication of administrators for requests that conduct directory traversal attack...

CVE-2015-3301

Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. dot dot in the tcpboxpath parameter in the checkouteditorsettings page to...

CVE-2015-3986

Cross-site request forgery CSRF vulnerability in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allows remote attackers to hijack the authentication of administrators for requests that conduct directory traversal attack...

CVE-2015-3300

CVE-2015-3300 covers multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress WordPress plugin (before 1.3.9.3). The affected components include checkout and admin pages, with exploitation possible through numerous input fields (billing/shipping address fields) and admin parameter ...

CVE-2015-3986

TheCartPress eCommerce Shopping Cart (WordPress plugin) is affected by CVE-2015-3986: CSRF allows remote attackers to hijack administrator sessions via directory traversal through tcp_box_path on the checkout_editor_settings page leading to wp-admin/admin.php. Affected versions: WordPress plugin ...

CVE-2015-3301

The CartPress/TheCartPress WordPress plugin (vulnerable before 1.3.9.3) suffers a Local PHP File Inclusion/Directory Traversal (CVE-2015-3301) via the tcp_box_path parameter in checkout_editor_settings (/wp-admin/admin.php?page=checkout_editor_settings). Exploitation requires administrative privi...

CVE-2015-3300

Multiple cross-site scripting XSS vulnerabilities in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allow remote attackers to inject arbitrary web script or HTML via the 1 billingfirstname, 2 billinglastname, 3...

WordPress Sites Backdoored, Leaking Credentials

WordPress site administrators just cannot come up for air. With a raft of WordPress vulnerabilities—most of them in plugins—to address, now comes word that a number of sites running the content management system have been compromised and are sending credentials via a backdoor to a criminal group...

WordPress CartPress Plugin Zero Day Disclosure

Another round of WordPress vulnerability disclosures has taken place with details made public on a handful of unpatched bugs in the CartPress ecommerce plugin. These disclosures come on the heels of a separate disclosure of a zero-day in the WordPress core engine. Those vulnerabilities have since...

TheCartPress <= 1.3.9 - Multiple Vulnerabilities

The TheCartPress eCommerce Shopping Cart WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability...

WordPress WPshop eCommerce 1.3.9.5 Shell Upload Exploit

This Metasploit module exploits an arbitrary file upload in the WordPress WPshop eCommerce plugin versions 1.3.3.3 to 1.3.9.5. It allows you to upload arbitrary PHP code and get remote code execution. This Metasploit module has been tested successfully on WordPress WPshop eCommerce 1.3.9.5 with...

WordPress WPshop eCommerce 1.3.9.5 Shell Upload

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'WordPress WPshop eCommerce Arbitrary File Upload Vulnerability', 'Description' = %q This module exploits an arbitrary file upload in...

Magento Patched Remote Execution Hole in eCommerce Platform

A nasty remote code execution vulnerability was recently patched in eBay’s eCommerce platform Magento. The hole, disclosed Monday, could put upwards to 200,000 company’s web stores, and their customers’ information at risk of being compromised. If exploited, researchers claim the vulnerability...

Shopify: XSS on ecommerce.shopify.com

Hello! I would like to report about XSS on ecommerce.shopify.com domain. Here is a PoC that gives You alert box with "123" content: https://ecommerce.shopify.com/grader?url=imdb.jurgens.lv This Ecommerce Store Grader Tool gives You a list of sources of image tags that should have "alt" attribute ...