27163 matches found
GHSA-MQXF-2998-C6CP Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table
Summary A stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. --- Proof of Concept Required Permissions - Admin access to edit/create Order...
EUVD-2026-10814
Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table...
Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table
Summary A stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. --- Proof of Concept Required Permissions - Admin access to edit/create Order...
GHSA-M6HV-X64C-27MM
creationtimestamp| type| source ---|---|--- 2026-03-10 18:10:05+00:00| seen| https://gist.github.com/alon710/9a8802d53b5fb158c5f6cb0e8400fffd...
CVE-2026-26111
creationtimestamp| type| source ---|---|--- 2026-03-10 16:57:37+00:00| seen| https://www.thezdi.com/blog/2026/3/10/the-march-2026-security-update-review 2026-03-10 19:02:37+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116206426958203363 2026-03-10 19:07:55+00:00| seen|...
CVE-2026-23669
creationtimestamp| type| source ---|---|--- 2026-03-10 16:57:37+00:00| seen| https://www.thezdi.com/blog/2026/3/10/the-march-2026-security-update-review 2026-03-10 18:49:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116206374174280022 2026-03-10 19:07:55+00:00| seen|...
GHSA-G644-9GFX-Q4Q4
creationtimestamp| type| source ---|---|--- 2026-03-10 16:29:43+00:00| seen| https://gist.github.com/abhu85/37e5770c487c142ffc50e5429b6fc363...
MINI-C2R2-R49G-MXWJ
Bulletin has no description...
CVE-2025-41711
creationtimestamp| type| source ---|---|--- 2026-03-10 07:23:01+00:00| seen| https://infosec.exchange/users/certvde/statuses/116203676038306087 2026-03-10 07:24:51+00:00| seen| https://infosec.exchange/users/certvde/statuses/116203682967755268...
CVE-2026-30862
creationtimestamp| type| source ---|---|--- 2026-03-10 03:00:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116202643726553087 2026-04-10 23:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/79787...
PT-2026-24630
Summary A stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. --- Proof of Concept Required Permissions - Admin access to edit/create Order...
PT-2026-24415
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This...
CVE-2026-29173: Improper Neutralization of Input During Web Page Generation
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This...
Craft Commerce cross-site scripting vulnerabilities
Craft Commerce is an e-commerce platform developed under the open-source Craft CMS framework. Versions prior to 4.10.2 and 5.5.3 of Craft Commerce contained a cross-site scripting vulnerability. This vulnerability stemmed from improper escaping of order status names during rendering, which could...
CVE-2026-28431
creationtimestamp| type| source ---|---|--- 2026-03-09 22:30:13+00:00| seen| https://infosec.exchange/users/offseq/statuses/116201580941905093...
GHSA-93FX-5QGC-WR38
creationtimestamp| type| source ---|---|--- 2026-03-09 20:10:06+00:00| seen| https://gist.github.com/alon710/56622a5fb0d29db6ad09ba417d4e4cd3...
CVE-2026-3638
creationtimestamp| type| source ---|---|--- 2026-03-09 19:30:13+00:00| seen| https://infosec.exchange/users/offseq/statuses/116200873186129950...
GHSA-HWX8-Q9CG-MQMC
creationtimestamp| type| source ---|---|--- 2026-03-09 19:10:06+00:00| seen| https://gist.github.com/alon710/3fd4142edf95384fd65face73227a201...