PT-2025-3762 · Unknown · Sourcecodester Online Eyewear Shop

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Eyewear Shop version 1.0 Description: A critical issue affects some unknown functionality of the file /orders/view order.php. The manipulation of the id argument leads to SQL injection. The attack may be launched remotel...

CVE-2024-53476

A race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to bypass inventory restrictions by simultaneously submitting purchase requests from multiple accounts for the same product. This can lead to overselling when stock is limited, as t...

SimplCommerce 安全漏洞

SimplCommerce is SimplCommerce open source a simple, cross-platform, modular e-commerce system built on . A security vulnerability exists in SimplCommerce. An attacker could exploit the vulnerability to bypass inventory limits and submit simultaneous purchase requests for the same product from...

CVE-2024-53476

CVE-2024-53476 concerns SimplCommerce with commit 230310c8d7a0408569b292c5a805c459d47a1d8f. A race condition in the checkout logic allows attackers to bypass inventory restrictions by submitting purchase requests from multiple accounts for the same product, leading to overselling when stock is li...

WordPress plugin Travel Booking 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Issuetrak 安全漏洞

Issuetrak is an issue tracking software from Issuetrak, Inc. A security vulnerability exists in Issuetrak version 17.1, which stems from the presence of a hidden field manipulation vulnerability, whereby when an authenticated user submits a work order, the request may be intercepted and...

No Fuss Computing Centurion ERP 安全漏洞

No Fuss Computing Centurion ERP is an open source enterprise resource planning ERP software from No Fuss Computing. A security vulnerability exists in No Fuss Computing Centurion ERP versions prior to 1.3.1, which originated when an authenticated user with work order viewing privileges could view...

Centreon 安全漏洞

Centreon is a set of open source system monitoring tools from the French company Centreon . The product provides monitoring capabilities for resources such as networks, systems, and applications. A security vulnerability exists in Centreon that stems from a possible SQL injection when creating wo...

CVE-2024-9828

The Taskbuilder WordPress plugin before 3.0.5 does not sanitize user input into the 'loadorders' parameter and uses it in a SQL statement, allowing high privilege users such as admin to perform SQL Injection attacks...

PT-2024-39870

Name of the Vulnerable Software and Affected Versions The Taskbuilder WordPress plugin versions prior to 3.0.5 Description The issue allows high privilege users, such as admins, to perform SQL Injection attacks due to the lack of sanitization of user input into the load orders parameter, which is...

WordPress plugin Taskbuilder 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-10853

The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the removeorder AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2024-10853

CVE-2024-10853 applies to Buy one click WooCommerce for WordPress (versions

CVE-2024-10853 Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Order Deletion

The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the removeorder AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2024-10544 Woo Manage Fraud Orders <= 2.6.1 - Unauthenticated Information Exposure via Log Files

The Woo Manage Fraud Orders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information about users contained in...

WordPress plugin Woo Manage Fraud Orders 日志信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A log information...

WordPress Woo Manage Fraud Orders plugin <= 6.1.7 - Unauthenticated Information Exposure via Log Files vulnerability

Unauthenticated Information Exposure via Log Files vulnerability discovered by Colin Xu in WordPress Plugin Woo Manage Fraud Orders versions = 6.1.7...

WordPress Woo Manage Fraud Orders Plugin <= 6.1.7 is vulnerable to Sensitive Data Exposure

Software Woo Manage Fraud Orders Type Plugin Vulnerable versions = 6.1.7 Fixed in N/A OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-10544 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 66ee55b75466 Credits Colin Xu Required...

CVE-2024-48143

A lack of rate limiting in the OTP validation component of Digitory Multi Channel Integrated POS v1.0 allows attackers to gain access to the ordering system and place an excessive amount of food orders...

PT-2024-33003 · Digitory · Digitory Multi Channel Integrated Pos

Name of the Vulnerable Software and Affected Versions: Digitory Multi Channel Integrated POS version 1.0 Description: The issue is related to a lack of rate limiting in the OTP validation component, which allows attackers to gain access to the ordering system. This can lead to an excessive amount...