CVE-2024-8949-POC

Broken Access Control Vulnerability was discoverd in Sourcecodester Online Eyewear Shopping Website ID,Cart ID Manipulation Leads to Unwanted Item Addition and Deletion into User's Cart CVE-2024-8949 Vendor: Sourcecodester...

CVE-2021-27190-PEEL-Shopping-cart-9.3.0-Stored-XSS

CVE-2021-27190 - PEEL Shopping, eCommerce shopping cart - Stored Cross-Site Scripting Vulnerability in 'Address' Date 2021-02-11 Exploit Author Anmol K Sachan Vendor Homepage https://www.peel.fr/ Software Link https://www.peel.fr/nos-offres-1/peel-shopping-31.html...

Marcos Penelas Cámara Next.js Ecommerce Template authorization issue vulnerability

The Marcos Penelas Cámara Next.js Ecommerce Template contains an authorization bypass vulnerability. This vulnerability arises from unauthorized access to user-controlled keys; shopping cart and wishlist operations rely solely on primary key matching without verifying the associated user...

WordPress Simple Shopping Cart plugin < 5.3.3 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Simple Shopping Cart versions 5.3.3...

CVE-2026-104642

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those...

CVE-2026-104641

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an...

CVE-2026-104642 Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification Bypass

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those...

CVE-2026-104642

The Simple Shopping Cart WordPress plugin (versions 5.1.3 - 5.3.2 ) is vulnerable to a Price Manipulation issue due to a Price Verification Bypass . The root cause is the plugin's failure to verify submitted product prices against values set exclusively by the site owner. This allows users with t...

CVE-2026-104642 Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification Bypass

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those...

WordPress Simple Shopping Cart plugin 5.1.3-5.3.2 - Contributor+ Price Manipulation vulnerability

Contributor+ Price Manipulation vulnerability discovered by Haemanth VJ in WordPress Plugin Simple Shopping Cart versions 5.1.3-5.3.2...

EUVD-2026-107144

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those...

CVE-2026-104641 Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an...

CVE-2026-104641

The Simple Shopping Cart WordPress plugin, version prior to 5.3.3 , is vulnerable to an unauthenticated payment bypass . In its default configuration, the plugin fails to verify that a PayPal IPN (Instant Payment Notification) corresponds to a payment received by the site owner's specific account...

EUVD-2026-107143

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an...

CVE-2026-104641 Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an...

PT-2026-120500

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an...

PT-2026-120501

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those...

VulnCheck KEV: CVE-2024-12253

The Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'savesettings', 'exportcsv', and 'simpleecommcart-action' actions in all versions up to, and including, 3.1.2. This makes it...

CVE-2026-105573

A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5. This impacts an unknown function of the file /jshERP-boot/accountHead/updateAccountHeadAndDetail of the component Shopping Cart Quantity Handler. Performing a manipulation of the argument goodsCount results in business logic errors...

CVE-2026-105573 newbee-ltd newbee-mall Shopping Cart Quantity updateAccountHeadAndDetail logic error

A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5. This impacts an unknown function of the file /jshERP-boot/accountHead/updateAccountHeadAndDetail of the component Shopping Cart Quantity Handler. Performing a manipulation of the argument goodsCount results in business logic errors...