CVE-2019-8289

CVE-2019-8289 affects Online Store v1.0 with a stored XSS in admin/user_view.php via the adidas_member_email parameter. Root cause: lack of proper input handling in that parameter leading to script injection when the page is rendered. Impact per sources: low confidentiality/integrity impact, no a...

CVE-2019-8292

The CVE-2019-8292 entry concerns Online Store System v1.0 where delete_product.php fails to verify authentication or administrative privileges, enabling arbitrary product deletion. This is an access control flaw (no authentication checks or admin rights verification) that directly affects the del...

CVE-2019-8288

The CVE-2019-8288 entry refers to a Stored Cross-Site Scripting vulnerability in Online Store v1.0, exploitable via the unsanitized adidas_member_user variable in user_view.php. Affected: Online Store v1.0 (component: user_view.php, variable: adidas_member_user). Root cause: lack of input sanitiz...

CVE-2019-8290

CVE-2019-8290 affects Online Store v1.0. The vulnerability arises from the registration flow: posting to sent_register.php allows special characters to bypass the member email format validation and enables an XSS payload to be injected. The connected materials confirm an XSS issue stemming from i...

CVE-2019-8291

The CVE-2019-8291 entry concerns Online Store System v1.0, specifically delete_file.php, which does not verify administrative rights and lacks path traversal protection. Publicly available connected records describe a path traversal vulnerability enabling access to locations outside restricted di...