CVE-2021-25062

The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the fileurl before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2021-25062

The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the fileurl before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2021-25062

The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the fileurl before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2021-25062

CVE-2021-25062 affects the Orders Tracking for WooCommerce WordPress plugin prior to 1.1.10. The vulnerability stems from insufficient sanitisation/escaping of the file_url in admin-page output, enabling Reflected Cross-Site Scripting. Impact is client-side script execution within the admin conte...

CVE-2021-25062 Orders Tracking for WooCommerce < 1.1.10 - Reflected Cross-Site Scripting

The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the fileurl before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

PT-2022-9618

Name of the Vulnerable Software and Affected Versions Orders Tracking for WooCommerce WordPress plugin versions prior to 1.1.10 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the file url is not properly sanitised and escaped before being outputted...

CVE-2021-25062: Improper Neutralization of Input During Web Page Generation

The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the fileurl before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2021-45788

Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter...

CVE-2021-24797

The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins...

CVE-2021-24797

The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins...

CVE-2021-24797 Tickera < 3.4.8.3 - Unauthenticated Stored Cross-Site Scripting

The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins...

PT-2021-16292

Name of the Vulnerable Software and Affected Versions: Tickera WordPress plugin versions prior to 3.4.8.3 Description: The issue allows unauthenticated users to perform Cross-Site Scripting attacks against admins due to improper sanitization and escaping of the Name fields of booked Events in the...

CVE-2021-24797: Improper Neutralization of Input During Web Page Generation

The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins...

CVE-2021-45788: Improper Neutralization of Special Elements used in an SQL Command

Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter...

PT-2021-23976

Name of the Vulnerable Software and Affected Versions: solidus frontend versions prior to 3.1.5 solidus frontend versions prior to 3.0.5 solidus frontend versions prior to 2.11.14 Description: The issue is a cross-site request forgery CSRF vulnerability that allows a malicious site to add an item...

CVE-2021-41557

Sofico Miles RIA 2020.2 Build 127964T is affected by Stored Cross Site Scripting XSS. An attacker with access to a user account of the RIA IT or the Fleet role can create a crafted work order in the damage reports section or change existing work orders. The XSS payload is in the work order number...

CVE-2021-41557

Sofico Miles RIA 2020.2 Build 127964T is affected by Stored Cross Site Scripting XSS. An attacker with access to a user account of the RIA IT or the Fleet role can create a crafted work order in the damage reports section or change existing work orders. The XSS payload is in the work order number...

Sofico Miles Ria跨站脚本漏洞

Sofico Miles Ria is a car rental management software from Sofico Belgium. A security vulnerability exists in Sofico Miles RIA version 2020.2 build 127964T, which allows an attacker to create a malicious work order in the damase report section or change an existing work order using a malicious...

prod-orders-bench.utorrent.com Cross Site Scripting vulnerability OBB-2298853

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ReDos vulnerability on guest checkout email validation

Impact Denial of service vulnerability that could be exploited during a guest checkout. The regular expression used to validate a guest order's email was subject to exponential backtracking through a fragment like a.a.. Before the patch, it can be reproduced in the console like this: ruby irbmain...