85 matches found
CVE-2025-52021
CVE-2025-52021 — PuneethReddyHC / Online Shopping System Advanced v1.0 中的基于时间的盲 SQL 注入 CVE： CVE-2025-52021 标题： 通过 editproduct.php 中的 productid 参数实现的基于时间的盲 SQL 注入 厂商 / 仓库： PuneethReddyHC — https://github.com/PuneethReddyHC/online-shopping-system-advanced 受影响版本： 1.0（测试时的分支/标签 master） 发现者： Hafiz...
CVE-2026-4945 Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watchcheckout' function due to missing validation on a user controlled key. This makes it possib...
CVE-2026-4945: Authorization Bypass Through User-Controlled Key
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watchcheckout' function due to missing validation on a user controlled key. This makes it possib...
CVE-2026-49228 Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a...
CVE-2026-49228
In Vvveb before 1.0.8.4, admin/controller/product/products.php accepts a caller-controlled product_id for duplicate and delete actions, and admin/sql/sqlite/product.sql fails to consistently enforce the current admin_id when view_other_products or edit_other_products is absent, allowing a low-pri...
CVE-2026-49228: Authorization Bypass Through User-Controlled Key
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a...
CVE-2017-20260 Joomla! Component Price Alert 3.0.2 SQL Injection
Joomla! Component Price Alert 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the productid parameter. Attackers can send requests to the subscribeajax view with crafted SQL payloads in the...
CVE-2017-20261: Improper Neutralization of Special Elements used in an SQL Command
Joomla! Component Bargain Product VM3 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the productid parameter. Attackers can supply crafted SQL statements in GET requests to the brainy and alice...
CVE-2017-20282: Improper Neutralization of Special Elements used in an SQL Command
Joomla! Component jCart for OpenCart 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the productid parameter. Attackers can send GET requests to index.php with the option=comjcart&route=product/product...
CVE-2017-20260: Improper Neutralization of Special Elements used in an SQL Command
Joomla! Component Price Alert 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the productid parameter. Attackers can send requests to the subscribeajax view with crafted SQL payloads in the...
EUVD-2021-34790
Opencart TMD Vendor System 3.x contains a blind SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the productid parameter. Attackers can craft malicious SQL queries using time-based or content-based blind injection...
CVE-2021-47928
Opencart TMD Vendor System 3.x contains a blind SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the productid parameter. Attackers can craft malicious SQL queries using time-based or content-based blind injection...
CVE-2021-47928: Improper Neutralization of Special Elements used in an SQL Command
Opencart TMD Vendor System 3.x contains a blind SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the productid parameter. Attackers can craft malicious SQL queries using time-based or content-based blind injection...
CVE-2025-14249
A security flaw has been discovered in code-projects Online Ordering System 1.0. The affected element is an unknown function of the file /userschool.php. The manipulation of the argument productid results in sql injection. The attack may be performed from remote. The exploit has been released to...
CVE-2025-14249: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in code-projects Online Ordering System 1.0. The affected element is an unknown function of the file /userschool.php. The manipulation of the argument productid results in sql injection. The attack may be performed from remote. The exploit has been released to...
EUVD-2009-4854
Malware in sbrugna...
EUVD-2019-16265
Malware in sbrugna...
EUVD-2006-0385
Malware in sbrugna...