Arbitrary file deletion

Merchandise Online Store v1.0 is vulnerable to file deletion via /vloggersmerch/classes/Master.php?f=deleteimg...

Sql injection

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggersmerch/admin/?page=maintenance/managesubcategory&id=...

Sql injection

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggersmerch/?p=products&c=...

Sql injection

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggersmerch/admin/?page=inventory/manageinventory&id=...

Sql injection

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggersmerch/?p=viewproduct&id=...

Sql injection

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggersmerch/classes/Master.php?f=deletecart...

Sql injection

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggersmerch/admin/orders/vieworder.php?view=user&id=...

Sql injection

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggersmerch/classes/Master.php?f=payorder...

Sql injection

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggersmerch/classes/Master.php?f=deletesubcategory...

Sql injection

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggersmerch/classes/Master.php?f=deletecategory...

Sql injection

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggersmerch/admin/?page=orders/vieworder&id=...

Sql injection

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggersmerch/admin/?page=maintenance/managecategory&id=...

Sql injection

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggersmerch/admin/?page=product/manageproduct&id=...

CVE-2022-30381

Merchandise Online Store v1.0 is vulnerable to file deletion via /vloggersmerch/classes/Master.php?f=deleteimg...

CVE-2022-30381

CVE-2022-30381 affects Merchandise Online Store v1.0, where an issue in Master.php?f=delete_img enables arbitrary file deletion. The vulnerability description specifies file deletion via the /vloggers_merch/classes/Master.php?f=delete_img endpoint, indicating that the underlying problem allows an...

CVE-2022-30384

CVE-2022-30384 affects Merchandise Online Store v1.0. The vulnerability is SQL Injection in /vloggers_merch/classes/Master.php?f=delete_inventory. NVD lists CVSS v2.0 base score 7.5 (PARTIAL CIA) and CVSS v3.1 base score 9.8 (HIGH impact, NETWORK, NO privileges). Multiple sources (RH, CNVD, CVE l...

CVE-2022-30384

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggersmerch/classes/Master.php?f=deleteinventory...

CVE-2022-30385

Merchandise Online Store v1.0 is affected by a SQL Injection vulnerability in the delete_order path (/vloggers_merch/classes/Master.php?f=delete_order). The issue arises from unsanitized input in the affected function, enabling SQL query manipulation. CVSS metrics indicate a high to critical impa...

CVE-2022-30385

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggersmerch/classes/Master.php?f=deleteorder...

CVE-2022-30386

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggersmerch/classes/Master.php?f=deletefeatured...