CVE-2023-49988

CVE-2023-49988 Hotel Booking Management v1.0 - rooms.php 中“npss”参数的SQL注入漏洞 描述 : Hotel Booking Management 1.0版本存在SQL注入漏洞。恶意攻击者可以通过编辑房型价格和折扣时使用易受攻击的参数npss、dpss、npsd、dpsd、npds、dpds、npdd、dpdd、npdst或dpdst，向MySQL数据库发送SQL命令。 受影响的产品版本 : Hotel Booking Management v1.0 CVE作者 : Geraldo Alcântara 日期 :...

CVE-2026-79410

Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate price of shippable goods...

CVE-2025-22510

CVE-2025-22510 1️⃣ Tipo de componente Plugin de WordPress 2️⃣ Detalles del componente Nombre del componente WC Price History for Omnibus Versión vulnerable = 2.1.4 Slug del componente wc-price-history Enlace del componente https://wordpress.org/plugins/wc-price-history/ 3️⃣ OWASP 2017: TOP 10 Clase...

TERM1B1TB0T

TERMI₿IT₿OT 🤖 一个基本工具，可通过 WebSocket API 在你的终端上实时跟踪高于或低于特定价格目标的比特币交易。 分步指南：WINDOWS -步骤 1：安装 Python（如果尚未安装） Download from python.org During install → make sure to check ✅ “Add Python to PATH” -打开 Windows Terminal / PowerShell -导航到你的机器人文件夹 cd \Users\Desktop\TERM1B1TB0T -步骤 2：安装依赖项（仅需一次） pip install...

CVE-2026-79410

Webkul Bagisto v2.4.9 is affected by improper validation of the quantity parameter in the add-to-cart path . An authenticated attacker can manipulate this parameter to reduce their order total below the legitimate price of shippable goods, resulting in a financial integrity impact. The vulnerabil...

CVE-2026-79410

Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate price of shippable goods...

EUVD-2026-79296

Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate price of shippable goods...

CVE-2024-50944

CVE-2024-50944 描述 SimplCommerce 的购物车逻辑存在整数溢出漏洞，允许通过构造的数量参数操纵产品数量和总价。 检测方法 攻击者可以通过向购物车添加数量为 2,147,483,647 的产品，然后再添加一个产品进行检测。如果数量和总价变为负数，则确认该站点存在整数溢出漏洞。 测试于 230310c8d7a0408569b292c5a805c459d47a1d8f commit 链接 https://www.simplcommerce.com/ https://github.com/simplcommerce/SimplCommerce...

CVE-2026-87892

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...

EUVD-2026-76803

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...

CVE-2026-87892 Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...

CVE-2026-87892

The Rox Appointment Booking WordPress plugin (versions before 1.2.0 ) fails to verify the order total or selected payment method against its own server-side pricing when creating a booking. This allows unauthenticated attackers to create confirmed bookings at an arbitrary price and bypass the sit...

CVE-2026-62136

Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce = 2.3.21 versions...

EUVD-2026-76201

Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce = 2.3.21 versions...

CVE-2025-48129

🚨 CVE-2025-48129 - WordPress Spreadsheet Price Changer 插件中的权限提升 🛡️ 漏洞摘要 受影响插件 ：Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light 受影响版本 ： 归类于：OWASP A7 – 身份识别与认证失败 🧪 漏洞利用脚本概述 此 Python 脚本针对插件受影响版本，仅使用邮箱和密码（通过 MD5 哈希）即可注册一个新的 WordPress 管理员。 ▶️ 示例用法 root@kitploit: python...

CVE-2026-85037

The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that...

CVE-2026-84908

The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnlloadpayment' AJAX action for both authenticated and unauthenticated wpajaxnopriv users and the underlying addofferproducttocart...

CVE-2026-85037 Sunshine Photo Cart < 3.7 - Unauthenticated Price Manipulation via IDOR

The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that...

WordPress Sunshine Photo Cart plugin < 3.7 - Unauthenticated Price Manipulation vulnerability

Unauthenticated Price Manipulation vulnerability discovered by Farid Narimanov in WordPress Plugin Sunshine Photo Cart versions 3.7...

EUVD-2026-74717

The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that...