CVE-2021-46444

H.H.G Multistore (v5.1.0 and below) is affected by a SQL injection in the admin panel via /admin/admin.php?module=admin_group_edit&agID. The issue arises from improper input handling in that endpoint, enabling attackers to manipulate queries. CVSS data indicates high impact (C/I/A high with CVSS3...

CVE-2021-46447

CVE-2021-46447 affects H.H.G Multistore (v5.1.0 and below). The vulnerability is a cross-site scripting (XSS) flaw exploitable via a crafted payload inserted into the State parameter under the Address Book module, enabling execution of arbitrary web scripts/HTML. The provided sources describe the...

CVE-2021-46445

CVE-2021-46445 affects H.H.G Multistore v5.1.0 and below. A SQL injection vulnerability exists in /admin/categories.php?box_group_id, enabling injection through the specified parameter. The entry is corroborated by multiple sources (NVD/CVE lists) and situates the impact as disclosed, with CVSS c...

CVE-2021-46446

CVE-2021-46446 affects H.H.G Multistore v5.1.0 and below, with a SQL injection vulnerability exposed via /admin/admin.php?module=admin_access_group_edit&aagID. Root cause: injectable SQL parameter in admin_access_group_edit handler. Impact (per sources): high/critical across confidentiality, inte...

CVE-2021-46448

CVE-2021-46448 affects H.H.G Multistore v5.1.0 and earlier. It is a SQL injection vulnerability in /admin/customers.php?page=1&cID, allowing attacker-controlled SQL execution. CVSS v3.1 base score 9.8 (CRITICAL); attack vector NETWORK, no privileges required, no user interaction. Impacts: confide...