95 matches found
EUVD-2026-68970
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'productorder' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...
CVE-2026-59529
The CVE-2026-59529 entry concerns the WordPress Ebook Store plugin versions ≤ 6.19 with an unauthenticated sensitive data exposure vulnerability. Provided details indicate an external attacker can access sensitive data without authentication (CVSS v3.1: 7.5 HIGH, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A...
CVE-2026-65453
Affected product: WordPress Ebook Store plugin, versions up to 6.19. The issue is an unauthenticated Broken Access Control vulnerability in Ebook Store
WordPress Ebook Store plugin <= 6.19 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by hivesec in WordPress Plugin Ebook Store versions = 6.19...
CVE-2018-25371 mooSocial Store Plugin 2.6 SQL Injection via product parameter
mooSocial Store Plugin 2.6 contains a blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the product parameter in URL rewrite functionality. Attackers can inject SQL code using boolean-based blind, time-based blind, or stacked query...
EUVD-2018-21892
mooSocial Store Plugin 2.6 contains a blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the product parameter in URL rewrite functionality. Attackers can inject SQL code using boolean-based blind, time-based blind, or stacked query...
CVE-2018-25371 mooSocial Store Plugin 2.6 SQL Injection via product parameter
mooSocial Store Plugin 2.6 contains a blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the product parameter in URL rewrite functionality. Attackers can inject SQL code using boolean-based blind, time-based blind, or stacked query...
CVE-2018-25371
The CVE-2018-25371 entry concerns mooSocial Store Plugin 2.6 with a blind SQL injection in the product parameter of the URL rewrite functionality. The vulnerability allows unauthenticated attackers to manipulate queries, enabling boolean-based blind, time-based blind, or stacked query techniques ...
CVE-2018-25371
mooSocial Store Plugin 2.6 contains a blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the product parameter in URL rewrite functionality. Attackers can inject SQL code using boolean-based blind, time-based blind, or stacked query...
PT-2026-43223
mooSocial Store Plugin 2.6 contains a blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the product parameter in URL rewrite functionality. Attackers can inject SQL code using boolean-based blind, time-based blind, or stacked query...
mooSocial Store Plugin SQL注入漏洞
mooSocial Store Plugin is a social e-commerce extension plugin from mooSocial. A SQL injection vulnerability exists in mooSocial Store Plugin version 2.6, which stems from a blind SQL injection via the product parameter in the URL rewriting feature, which could lead to database query manipulation...
CVE-2016-10992
The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports fromyear parameter...
EUVD-2016-1983
Malware in sbrugna...
EUVD-2024-50726
Malicious code in bioql PyPI...
EUVD-2023-49894
Malicious code in bioql PyPI...
EUVD-2023-26819
Malicious code in bioql PyPI...
EUVD-2025-22267
Malicious code in bioql PyPI...
EUVD-2025-22477
Malicious code in bioql PyPI...
CVE-2025-8113
The Ebook Store WordPress plugin before 5.8015 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...
CVE-2025-8113 Ebook Store < 5.8015 - Reflected XSS via $_SERVER['REQUEST_URI']
The Ebook Store WordPress plugin before 5.8015 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...