CVE-2017-17938

PHP Scripts Mall Single Theater Booking has XSS via the admin/viewtheatre.php theatreid parameter...

CVE-2017-17940

PHP Scripts Mall Single Theater Booking has XSS via the title parameter to admin/sitesettings.php...

CVE-2017-17960: Cross-Site Request Forgery (CSRF)

PHP Scripts Mall PHP Multivendor Ecommerce has CSRF via admin/sellerupd.php...

CVE-2017-17959: Improper Neutralization of Special Elements used in an SQL Command

PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the seller-view.php usid parameter...

CVE-2017-17958: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the mywishlist.php fid parameter...

CVE-2017-17957: Improper Neutralization of Special Elements used in an SQL Command

PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the mywishlist.php fid parameter...

CVE-2017-17955: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the shopping-cart.php cusid parameter...

CVE-2017-17953: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the category.php chid1 parameter...

CVE-2017-17952: Improper Input Validation

PHP Scripts Mall PHP Multivendor Ecommerce has a predicable registration URL, which makes it easier for remote attackers to register with an invalid or spoofed e-mail address...

CVE-2017-17951: Improper Neutralization of Special Elements used in an SQL Command

PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the shopping-cart.php cusid parameter...

PT-2017-15130

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall PHP Multivendor Ecommerce affected versions not specified Description The issue is related to SQL Injection, which can be exploited via the usid parameter in the "seller-view.php" API endpoint. Recommendations For PHP Scripts...

PT-2017-15122

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall PHP Multivendor Ecommerce affected versions not specified Description The issue concerns a SQL Injection vulnerability. It is exploited via the cusid parameter in the "shopping-cart.php" endpoint. Recommendations At the moment...

PT-2017-15124

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall PHP Multivendor Ecommerce affected versions not specified Description The issue concerns a security problem where an attacker can execute malicious scripts. This is achieved through the category.php endpoint, specifically by...

CVE-2017-17956: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the admin/sellerupd.php companyname parameter...

CVE-2017-17940: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Single Theater Booking has XSS via the title parameter to admin/sitesettings.php...

CVE-2017-17938: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Single Theater Booking has XSS via the admin/viewtheatre.php theatreid parameter...

CVE-2017-17941: Improper Neutralization of Special Elements used in an SQL Command

PHP Scripts Mall Single Theater Booking has SQL Injection via the admin/movieview.php movieid parameter...

CVE-2017-17939: Cross-Site Request Forgery (CSRF)

PHP Scripts Mall Single Theater Booking has CSRF via admin/sitesettings.php...

PHP Scripts Mall Single Theater Booking Cross-Site Scripting Vulnerability (CNVD-2018-00498)

PHP Scripts Mall Single Theater Booking is an open source theater script. A cross-site scripting vulnerability exists in PHP Scripts Mall Single Theater Booking. A remote attacker can inject arbitrary web script or HTML by sending the 'title' parameter to the admin/sitesettings.php file...

PT-2017-15116

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Single Theater Booking affected versions not specified Description The issue is related to a security problem where an attacker can inject malicious code. This is possible due to insufficient input validation in the title...