114 matches found
WooCommerce Ultimate Gift Card ≤ 2.6.0 - Arbitrary File Upload
The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwbwgmpreviewmail' and 'mwbwgmwoocommerceaddcartitemdata' functions in all versions up to, and including, 2.6.0. This makes it possible for...
CVE-2024-8425
Wordpress WooCommerce Ultimate Gift Card = 2.6.0 - 未认证任意文件上传 CVE-2024-8425 WordPress 的 WooCommerce Ultimate Gift Card 插件容易受到任意文件上传攻击，原因是在包括 2.6.0 在内的所有版本中，'mwbwgmpreviewmail' 和 'mwbwgmwoocommerceaddcartitemdata' 函数对文件类型验证不足。这使得未认证的攻击者可以在受影响站点的服务器上上传任意文件，从而可能实现远程代码执行。 如需更多 WordPress...
CVE-2024-11423
CVE-2024-11423 Ultimate Gift Cards for WooCommerce = 3.0.6 - 未授权访问导致无限金钱漏洞 描述 适用于 WordPress 的 Ultimate Gift Cards for WooCommerce 插件（用于创建 WooCommerce 礼品卡、礼品券，兑换和管理数字礼品优惠券；提供礼品证书、定时发送礼品卡，并使用带个性化模板的高级优惠券）在直至 3.0.6 的所有版本中，由于多个 REST API 端点（例如...
CVE-2026-11764
When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not have permission to view gift cards. This is inconsistent with the UI and API where only the first letters of the gift card secret are shown...
CVE-2026-11764
When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not have permission to view gift cards. This is inconsistent with the UI and API where only the first letters of the gift card secret are shown...
EUVD-2026-35407
When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not have permission to view gift cards. This is inconsistent with the UI and API where only the first letters of the gift card secret are shown...
CVE-2026-11764 Data exposed without proper permission
When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not have permission to view gift cards. This is inconsistent with the UI and API where only the first letters of the gift card secret are shown...
CVE-2026-11764 Data exposed without proper permission
When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not have permission to view gift cards. This is inconsistent with the UI and API where only the first letters of the gift card secret are shown...
PT-2026-47750
When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not have permission to view gift cards. This is inconsistent with the UI and API where only the first letters of the gift card secret are shown...
CVE-2019-7855
A cryptograhic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could be abused by an unauthenticated user to discover an invariant used in gift card generation...
Holiday scams 2025: These common shopping habits make you the easiest target
Every year, shoppers get faster, savvier, and more mobile. We compare prices on the go, download apps for coupons, and jump on deals before they disappear. But during deal-heavy periods like Black Friday, Cyber Monday, and the December shopping rush, convenience can work against us. Quick...
Watch out for Walmart gift card scams
You’ve probably seen it before—a bright, urgent message claiming you’ve qualified for a $750 or $1000 Walmart gift card. All you have to do is answer a few questions. It looks harmless enough. But once you click, you find yourself in a maze of surveys, redirects, and "partner offers"—without ever...
'Jingle Thief' Hackers Exploit Cloud Infrastructure to Steal Millions in Gift Cards
Cybersecurity researchers have shed light on a cybercriminal group called Jingle Thief that has been observed targeting cloud environments associated with organizations in the retail and consumer services sectors for gift card fraud. "Jingle Thief attackers use phishing and smishing to steal...
EUVD-2020-23293
Malware in sbrugna...
EUVD-2024-52072
Malicious code in bioql PyPI...
EUVD-2022-2056
Malicious code in bioql PyPI...
EUVD-2025-27441
Malicious code in bioql PyPI...
CVE-2025-47569
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPSwings WooCommerce Ultimate Gift Card woocommerce-ultimate-gift-card allows Blind SQL Injection.This issue affects WooCommerce Ultimate Gift Card: from n/a through = 2.9.6...
CVE-2025-47569
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPSwings WooCommerce Ultimate Gift Card woocommerce-ultimate-gift-card allows Blind SQL Injection.This issue affects WooCommerce Ultimate Gift Card: from n/a through = 2.9.6...
