PT-2026-84051

Name of the Vulnerable Software and Affected Versions ShopEx ECShop versions prior to 2.5.2 Description A remote SQL injection exists in the flow update cart function within the '/flow.php?step=update cart' endpoint. This issue occurs when the rec id variable is manipulated, allowing an attacker ...

Brute Force

Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Brute Force in the actionUpdateCart process when the 'number' parameter is not provided, which disables rate limiting. An attacker can enumerate valid coupon codes by sending automated requests...

CVE-2023-0686

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been classified as critical. This affects the function updatecart of the file /oews/classes/Master.php?f=updatecart of the component HTTP POST Request Handler. The manipulation of the argument cartid leads to sql injectio...

CSRF Lost cart availability to all customer

Description The absence of input validation in the update cart form Qty feature causes the feature to become an error / blank by simply changing the number to a string. In order to occur in all users the role of CSRF is required so that Severity user interaction is required. So you could say thes...

CVE-2023-0686

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been classified as critical. This affects the function updatecart of the file /oews/classes/Master.php?f=updatecart of the component HTTP POST Request Handler. The manipulation of the argument cartid leads to sql injectio...

PT-2023-16455 · Sourcecodester · Sourcecodester Online Eyewear Shop

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Eyewear Shop version 1.0 Description: A critical issue has been found, affecting the function update cart of the file /oews/classes/Master.php?f=update cart in the HTTP POST Request Handler component. The manipulation of...

CSRF on update cart functionality

I found a CSRF Vulnerability in the update cart functionality where there is no csrf token being validated While updating the cart as the authenticated user Vulnerable Request: POST /demo/api/updatecart HTTP/1.1 Host: demo.microweber.org Cookie:...