mall.ccworld.net Cross Site Scripting vulnerability OBB-3550566

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

SDCMS has an information leakage vulnerability

SDCMS is a B2C mall website management system independently developed by Vivid Network, PHP four-in-one website management system. SDCMS has an information leakage vulnerability, which can be exploited by attackers to obtain sensitive information...

SQL Injection Vulnerability in HongYuJD

HongYuJD is a mall website system of HongYu technology team. HongYuJD suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

PT-2019-10127

Name of the Vulnerable Software and Affected Versions: PHP Scripts Mall Website Seller Script version 2.0.5 Description: The issue allows for full Path Disclosure via a request for an arbitrary image URL, such as a .png file. Recommendations: For version 2.0.5, update to a newer version that...

CVE-2018-20631: Improper Limitation of a Pathname to a Restricted Directory

PHP Scripts Mall Website Seller Script 2.0.5 allows full Path Disclosure via a request for an arbitrary image URL such as a .png file...

Design/Logic Flaw

PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896...

CVE-2018-20530: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896...

PT-2018-15415

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Website Seller Script version 2.0.5 Description The issue is related to a Cross-Site Scripting XSS vulnerability. It can be triggered via a Profile field, such as the Company Address. Recommendations For PHP Scripts Mall Websi...

CVE-2018-16456: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a keyword. NOTE: This may overlap with CVE-2018-6870 which has XSS via the Listings Search feature...

CVE-2018-15896: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Website Seller Script 2.0.5 has XSS via Personal Address or Company Name...

PT-2018-13276

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Website Seller Script version 2.0.5 Description The issue is related to a problem where an attacker can execute a cross-site scripting XSS attack via the Personal Address or Company Name fields. Recommendations For version...

PT-2018-13277

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Website Seller Script version 2.0.5 Description The issue allows remote attackers to cause a denial of service via crafted JavaScript code in the First Name, Last Name, Company Name, or Fax field. Recommendations For PHP Scrip...

CVE-2018-15897: Improper Restriction of Operations within the Bounds of a Memory Buffer

PHP Scripts Mall Website Seller Script 2.0.5 allows remote attackers to cause a denial of service via crafted JavaScript code in the First Name, Last Name, Company Name, or Fax field, as demonstrated by crossPwn...

CVE-2018-11501

PHP Scripts Mall Website Seller Script 2.0.3 has CSRF via usersubmit.php?upd=2, with resultant XSS...

CVE-2018-11501: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Website Seller Script 2.0.3 has CSRF via usersubmit.php?upd=2, with resultant XSS...

PT-2018-10618

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Website Seller Script version 2.0.3 Description The issue allows for CSRF via the user submit.php endpoint with the upd parameter set to 2, resulting in XSS. Recommendations For version 2.0.3, as a temporary workaround, consid...

PT-2018-17809

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Website Broker Script version 3.0.6 Description The issue concerns a problem where an attacker can inject malicious code via the Last Name field on the My Profile page, potentially leading to unauthorized actions on the websit...

PT-2018-17793

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Website Seller Script version 2.0.3 Description A reflected XSS issue exists in the Listings Search feature, allowing for potential exploitation. Recommendations For version 2.0.3, update the Listings Search feature to properl...

PT-2018-17799

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Website Seller Script version 2.0.3 Description The issue allows remote attackers to modify a registered e-mail address by removing the validation code, as the validation of an e-mail address is enforced on the client side...

CVE-2018-6879: Improper Input Validation

PHP Scripts Mall Website Seller Script 2.0.3 uses the client side to enforce validation of an e-mail address, which allows remote attackers to modify a registered e-mail address by removing the validation code...