mall.ccworld.net Cross Site Scripting vulnerability OBB-3550566

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

SDCMS has an information leakage vulnerability

SDCMS is a B2C mall website management system independently developed by Vivid Network, PHP four-in-one website management system. SDCMS has an information leakage vulnerability, which can be exploited by attackers to obtain sensitive information...

SQL Injection Vulnerability in HongYuJD

HongYuJD is a mall website system of HongYu technology team. HongYuJD suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

CVE-2018-20631: Improper Limitation of a Pathname to a Restricted Directory

PHP Scripts Mall Website Seller Script 2.0.5 allows full Path Disclosure via a request for an arbitrary image URL such as a .png file...

Design/Logic Flaw

PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896...

CVE-2018-20530: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896...

CVE-2018-16456: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a keyword. NOTE: This may overlap with CVE-2018-6870 which has XSS via the Listings Search feature...

CVE-2018-15896: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Website Seller Script 2.0.5 has XSS via Personal Address or Company Name...

CVE-2018-15897: Improper Restriction of Operations within the Bounds of a Memory Buffer

PHP Scripts Mall Website Seller Script 2.0.5 allows remote attackers to cause a denial of service via crafted JavaScript code in the First Name, Last Name, Company Name, or Fax field, as demonstrated by crossPwn...

CVE-2018-11501

PHP Scripts Mall Website Seller Script 2.0.3 has CSRF via usersubmit.php?upd=2, with resultant XSS...

CVE-2018-11501: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Website Seller Script 2.0.3 has CSRF via usersubmit.php?upd=2, with resultant XSS...

CVE-2018-6900: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Website Broker Script 3.0.6 has XSS via the Last Name field on the My Profile page...

CVE-2018-6879: Improper Input Validation

PHP Scripts Mall Website Seller Script 2.0.3 uses the client side to enforce validation of an e-mail address, which allows remote attackers to modify a registered e-mail address by removing the validation code...

CVE-2018-6870: Improper Neutralization of Input During Web Page Generation

Reflected XSS exists in PHP Scripts Mall Website Seller Script 2.0.3 via the Listings Search feature...