Magento 2 Community Edition Cross-site Scripting Vulnerability

A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of the store design schedule...

CVE-2022-30454

Merchandise Online Store 1.0 is vulnerable to SQL Injection via /vloggersmerch/classes/Master.php?f=deleteproduct...

CVE-2022-30454

Merchandise Online Store 1.0 is vulnerable to SQL Injection via /vloggersmerch/classes/Master.php?f=deleteproduct...

CVE-2022-30454

Merchandise Online Store 1.0 is vulnerable to SQL Injection via /vloggersmerch/classes/Master.php?f=deleteproduct...

Sql injection

Merchandise Online Store 1.0 is vulnerable to SQL Injection via /vloggersmerch/classes/Master.php?f=deleteproduct...

CVE-2022-30454

Summary: CVE-2022-30454 affects Merchandise Online Store 1.0 and is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_product. What is affected: The application Merchandise Online Store 1.0; vulnerability is in the delete_product path parameter. Nature of vulnerability: ...

CVE-2022-30454

Merchandise Online Store 1.0 is vulnerable to SQL Injection via /vloggersmerch/classes/Master.php?f=deleteproduct...

SQL Injection

Description A SQL Injection in rqlite store Proof of Concept use example code go package main import "io" "log" "net/http" "github.com/alexedwards/scs/rqlitestore" "github.com/alexedwards/scs/v2" "github.com/rqlite/gorqlite" var sessionManager scs.SessionManager func main // Establish connection ...

Multi Store Inventory Management System授权问题漏洞

Multi Store Inventory Management System is a multi-store inventory management system. version 1.0 of Multi Store Inventory Management System is vulnerable to an authorization issue. An attacker can exploit this vulnerability to perform an account takeover via a specially crafted POST request...

Merchandise Online Store SQL注入漏洞

Merchandise Online Store is a merchandise online store system. merchandise Online Store version 1.0 is vulnerable to SQL injection, which can be exploited by attackers via /vloggersmerch/classes/Master.php?f=delete product to conduct SQL injection attacks...

Airfield Online 授权问题漏洞

Airfield Online is an online store system from Airfield, Inc. Airfield Online suffers from an authorization issue vulnerability that could be exploited by an attacker to access sensitive data without proper authentication...

Kubernetes Secrets Store CSI Driver plugins arbitrary file write

Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods...

Kubernetes Secrets Store CSI Driver plugins arbitrary file write

Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods...

CVE-2018-12356

An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2. The signature verification routine parses the output of GnuPG with an incomplete regular expression, which allows remote attackers to spoof file signatures on configuration files and extension script...

CVE-2022-28993

Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request...

CVE-2022-28991

Multi Store Inventory Management System v1.0 was discovered to contain an information disclosure vulnerability which allows attackers to access sensitive files...

CVE-2022-28993

Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request...

Cross site request forgery (csrf)

Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request...

CVE-2022-28993

The CVE-2022-28993 entry concerns Multi Store Inventory Management System v1.0 with an authorization issue that enables account takeover via a crafted POST request. Affected component is the web application’s access control logic; root cause is not explicitly detailed across sources, but multiple...

CVE-2022-28991

CVE-2022-28991 affects Multi Store Inventory Management System v1.0. The described vulnerability is an information disclosure that could allow attackers to access sensitive files. The provided documents do not specify the root cause, exploit details, or a remediation/fix. No exploitation status i...