WordPress Easy Order View Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Easy Order View Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 06032b452cdb Credits Rafie Muhammad Patchstack Required...

CVE-2023-27210

Online Pizza Ordering System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/vieworder.php...

Magento Community Edition < 1.9.2.3 Multiple Vulnerabilities

Binary data 9679.prm...

ecshop the goods_attr and goods_attr_id two secondary injection vulnerability detailed analysis-vulnerability warning-the black bar safety net

A: goodsattrid secondary injection ! 2 0 1 3 0 7 3 0 1 5 2 7 4 9 1 Injection use process: 1. Add items to your cart, write the injection code to product attribute id http://localhost/test/ecshop/flow.php?step=addtocart POST: goods="quick":1,"spec":"1 6 3","1 5 8'","goodsid":3...

ecshop最新版本前台二次注入系列(2)

简要描述： 二次注入第二枚，这个点的注入内容至少进出数据库6次才最终到达了注入结果页面，当然全程可控。 详细说明： 先上注入结果图： SQL注入流程： 1.插入注入代码goodsattr至订单商品/wholesale.php可以插入,即商品批发页面，这里的goodsattr和 WooYun: ecshop最新版本前台二次注入系列1 里goodsattrid是不同的，之前的漏洞即正常在商品页面加入购物车是不能控制goodsattr的，当时goodsattr从数据库商品属性表读取。 2.将1生成的订单在用户中心订单查看页执行“放回购物车”操作。 3.查看购物车页面，注入代码执行 代码分析：...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Ubercart 5.x before 5.x-1.0-rc1 module for Drupal allow remote attackers to inject arbitrary web script or HTML via text fields intended for the 1 address and 2 order information, which are later displayed on the order view page and...