CVE-2022-41655

Auth. subscriber+ Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin = 3.7.1 on WordPress...

Code injection

Auth. subscriber+ Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin = 3.7.1 on WordPress...

CVE-2022-41655

CVE-2022-41655 affects the WordPress plugin Phone Orders for WooCommerce (versions ≤ 3.7.1). The root issue is a sensitive data exposure that is accessible to authenticated users with subscriber-level privileges (and higher). Documented impact is exposure of Auth. (subscriber+) data. The vulnerab...

PT-2022-26008 · WordPress · Phone Orders For Woocommerce

Name of the Vulnerable Software and Affected Versions: Phone Orders for WooCommerce plugin version 3.7.1 and earlier Description: The issue concerns a Sensitive Data Exposure vulnerability in the Phone Orders for WooCommerce plugin for WordPress, affecting authenticated users with subscriber or...

WordPress plugin Phone Orders for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Seller can steal ETH which is for other orders of the bulk

Lines of code Vulnerability details Impact The 'bulkExecute' and 'returnDust' functions are susceptible to reentrancy attack. Seller can exploit it to steal ETH which is for other orders of the bulk. Proof of Concept Key steps for successful attack 1 set fee rate to 100% 2 reentrancy call...

No Revert on Failure, an order can be execute successfully by disguising them as NFTs.

Lines of code Vulnerability details Impact ERC20 tokens don't throw a error when failed in transfer. A malicious user can pretend to be sending an ERC721 token while it is something else. Orders are getting executed inside LooksRareProxy.sol, an attacker as a maker can make an BasicOrder that has...

CVE-2022-42990

Food Ordering Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /foms/all-orders.php?status=Cancelled%20by%20Customer...

PT-2022-26697 · Unknown · Food Ordering Management System

Name of the Vulnerable Software and Affected Versions: Food Ordering Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the component /foms/all-orders.php?status=Cancelled%20by%20Customer. This vulnerability allows for potenti...

Food Ordering Management System SQL注入漏洞

Food Ordering Management System is a food ordering management system by Carlo Montero personal developer. It provides an online platform to order food from a restaurant or fast food chain. A security vulnerability exists in Food Ordering Management System v1.0, which was discovered to contain an...

CVE-2022-43354

Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/managerequest...

CVE-2022-43354

Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/managerequest...

Sql injection

Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/vieworder...

Sql injection

Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/managerequest...

Sanitization Management System SQL注入漏洞

Sanitization Management System is a sanitization management system by Carlo Montero Personal Developer. Sanitization Management System v1.0 is vulnerable to a SQL injection vulnerability that was discovered via the id parameter of /admin/?page=orders/managerequest to contain a SQL injection...

Online Medicine Ordering System 安全漏洞

Online Medicine Ordering System is an online medicine ordering system by Carlo Montero, an individual developer. A security vulnerability exists in version 1.0 of the Online Medicine Ordering System due to an unknown function in its admin/?page=orders/vieworder file that operates on the parameter...

PT-2022-23834 · Unknown · Sourcecodester Online Medicine Ordering System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Medicine Ordering System version 1.0 Description: A critical issue has been found in the system, affecting an unknown function of the file "admin/?page=orders/view order". The manipulation of the id argument leads to SQL...

WordPress Phone Orders for WooCommerce plugin <= 3.7.1 - Auth. Sensitive Data Exposure vulnerability

Auth. Sensitive Data Exposure vulnerability discovered by Lana Codes Patchstack Alliance in WordPress Phone Orders for WooCommerce plugin versions = 3.7.1. Solution Update the WordPress Phone Orders for WooCommerce plugin to the latest available version at least 3.7.2...

The vulnerability of the D-Bus inter-process communication system, related to memory corruption after deallocation, allows a malicious actor to trigger a service failure.

The vulnerability of the D-Bus inter-process communication mechanism is related to a memory usage error that occurs after freeing memory, caused by messages with non-sequential byte orders and Unix file descriptors. Exploiting this vulnerability can allow an attacker to cause service failures...

Upgraded Q -> M from 873 [1666362235337]

Judge has assessed an item in Issue 873 as Medium risk. The relevant finding follows: Avoid payableaddress.transfer GolomTraderpayEther uses payableaddress.transfer to send native ETH. It's considered a best practice to avoid this pattern for ETH transfers, since it forwards a fixed gas stipend...