WordPress Packlink PRO shipping module Plugin <= 3.4.6 is vulnerable to Broken Access Control

Software Packlink PRO shipping module Type Plugin Vulnerable versions = 3.4.6 Fixed in 3.4.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-38740 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID fbec632c2a75 Credits Dhabaleshwar Das...

CVE-2024-6506

Information exposure vulnerability in the MRW plugin, in its 5.4.3 version, affecting the "mrwlog" functionality. This vulnerability could allow a remote attacker to obtain other customers' order information and access sensitive information such as name and phone number. This vulnerability also...

CVE-2024-6506 Information exposure vulnerability in the MRW plug-in

Information exposure vulnerability in the MRW plugin, in its 5.4.3 version, affecting the "mrwlog" functionality. This vulnerability could allow a remote attacker to obtain other customers' order information and access sensitive information such as name and phone number. This vulnerability also...

CVE-2024-6506 Information exposure vulnerability in the MRW plug-in

Information exposure vulnerability in the MRW plugin, in its 5.4.3 version, affecting the "mrwlog" functionality. This vulnerability could allow a remote attacker to obtain other customers' order information and access sensitive information such as name and phone number. This vulnerability also...

CVE-2024-6506

CVE-2024-6506 affects MRW plugin version 5.4.3, specifically the mrw_log functionality. The exposed data includes other customers’ order information and sensitive fields such as names and phone numbers, with an ability to create or overwrite shipping labels. The CVSSv3.1 base score is 8.2 (HIGH) ...

PT-2024-37676 · Unknown · Mrw Plugin

Name of the Vulnerable Software and Affected Versions: MRW plugin version 5.4.3 Description: The issue is an information exposure vulnerability affecting the "mrw log" functionality. This could allow a remote attacker to obtain other customers' order information and access sensitive information...

WordPress Alfred Easy Shipping plugin <= 1.0.5 - Malicious Polyfill.io Embed vulnerability

Malicious Polyfill.io Embed vulnerability discovered by Sansec.io in WordPress Plugin Alfred Easy Shipping versions = 1.0.5...

WordPress Alfred Easy Shipping Plugin <= 1.0.5 is vulnerable to Backdoor

Software Alfred Easy Shipping Type Plugin Vulnerable versions = 1.0.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Backdoor CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID c071f3d22627 Credits Sansec.io Required privilege Unauthenticated Published 3 July,...

CVE-2024-5768

The MIMO Woocommerce Order Tracking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mimoupdateprovider' function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2024-5768

CVE-2024-5768 affects MIMO Woocommerce Order Tracking (WordPress). The vulnerability is due to a missing capability check in mimo_update_provider, affecting all versions up to and including 1.0.2. Exploitation requires Subscriber+ authenticated access and can enable unauthorized modification of s...

CVE-2024-37621

StrongShop v1.0 was discovered to contain a Server-Side Template Injection SSTI vulnerability via the component /shippingOptionConfig/index.blade.php...

PT-2024-27678 · Unknown · Strongshop

Name of the Vulnerable Software and Affected Versions: StrongShop version 1.0 Description: A Server-Side Template Injection SSTI issue was found in the /shippingOptionConfig/index.blade.php component. Recommendations: For StrongShop version 1.0, consider restricting access to the vulnerable...

CVE-2023-51498

Missing Authorization vulnerability in Woo WooCommerce Canada Post Shipping.This issue affects WooCommerce Canada Post Shipping: from n/a through 2.8.3...

CVE-2023-51498 WordPress WooCommerce Canada Post Shipping plugin <= 2.8.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Woo WooCommerce Canada Post Shipping.This issue affects WooCommerce Canada Post Shipping: from n/a through 2.8.3...

CVE-2023-51498 WordPress WooCommerce Canada Post Shipping plugin <= 2.8.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Woo WooCommerce Canada Post Shipping.This issue affects WooCommerce Canada Post Shipping: from n/a through 2.8.3...

WordPress plugin WooCommerce Canada Post Shipping Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability exists in th...

CVE-2024-32811

Insertion of Sensitive Information into Log File vulnerability in Octolize USPS Shipping for WooCommerce – Live Rates.This issue affects USPS Shipping for WooCommerce – Live Rates: from n/a through 1.9.4...

CVE-2024-32811 WordPress USPS Shipping for WooCommerce – Live Rates plugin <= 1.9.4 - Sensitive Data Exposure via Log File vulnerability

Insertion of Sensitive Information into Log File vulnerability in Octolize USPS Shipping for WooCommerce – Live Rates.This issue affects USPS Shipping for WooCommerce – Live Rates: from n/a through 1.9.4...

CVE-2024-32811

CVE-2024-32811 affects the WordPress plugin USPS Shipping for WooCommerce – Live Rates by Octolize. It exposes sensitive information via log files when logging data (Insertion of Sensitive Information into Log File). Affected versions are from n/a through 1.9.4. CVSS v3.1 base score 5.3 (Network,...

convoy-shipping.com Cross Site Scripting vulnerability OBB-3932171

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...