Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
295 results · page 3 of 6
Sep 10, 2025Welcart e-Commerce: Stored Cross-Site ScriptingCVE-2025-9367 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 2.11.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Welcart e-Commerce
- Affected
- up to 2.11.20
- What to do
- Affects up to 2.11.20. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Sep 9, 2025Saleor is an e-commerce platform.CVE-2025-58442 · Other software · saleor · reported by GitHubMedium 5.3
Saleor is an e-commerce platform. Starting in version 3.21.0 and prior to version 3.21.16, requesting certain fields in the response of `accountRegister` may result in errors that could unintentionally reveal whether a user with the provided email already exists in Saleor. Version 3.21.16 fixes the issue. As a workaround, rate-limit the mutation to reduce the impact.
- Product
- saleor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Welcart e-Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58984 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through <= 2.11.20.
- Product
- Welcart e-Commerce
- Affected
- up to 2.11.20
- What to do
- Affects up to 2.11.20. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025Welcart e-Commerce: Deserialization of Untrusted DataCVE-2025-54012 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Object Injection.This issue affects Welcart e-Commerce: from n/a through <= 2.11.16.
- Product
- Welcart e-Commerce
- Affected
- up to 2.11.16
- What to do
- Affects up to 2.11.16. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025The E-Commerce ERP: Missing AuthorizationCVE-2025-52800 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in Unity Business Technology Pty Ltd The E-Commerce ERP profitori allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects The E-Commerce ERP: from n/a through <= 2.1.1.3.
- Product
- The E-Commerce ERP
- Affected
- up to 2.1.1.3
- What to do
- Affects up to 2.1.1.3. Update The E-Commerce ERP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 19, 2025WPshop 2 – E-Commerce: Arbitrary file uploadsCVE-2015-10135 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxUpload function in versions before 1.3.9.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
- Product
- WPshop 2 – E-Commerce
- Fixed in
- 1.3.9.6
- What to do
- Update WPshop 2 – E-Commerce to 1.3.9.6 or newer.
Full record and what to do →NVD recordg0blin.co.ukgithub.com
Jul 16, 2025The E-Commerce ERP: Incorrect Privilege AssignmentCVE-2025-52836 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Unity Business Technology Pty Ltd The E-Commerce ERP profitori allows Privilege Escalation.This issue affects The E-Commerce ERP: from n/a through <= 2.1.1.3.
- Product
- The E-Commerce ERP
- Affected
- up to 2.1.1.3
- What to do
- Affects up to 2.1.1.3. Update The E-Commerce ERP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025Welcart e-Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54013 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through <= 2.11.16.
- Product
- Welcart e-Commerce
- Affected
- up to 2.11.16
- What to do
- Affects up to 2.11.16. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: Incorrect Privilege AssignmentCVE-2025-48129 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Privilege Escalation.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.
- Product
- Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light
- Affected
- up to 2.4.37
- What to do
- Affects up to 2.4.37. Update Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-48124 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Path Traversal.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.
- Product
- Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light
- Affected
- up to 2.4.37
- What to do
- Affects up to 2.4.37. Update Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: Improper Control of Generation of Code ('Code Injection')CVE-2025-48123 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Code Injection.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.
- Product
- Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light
- Affected
- up to 2.4.37
- What to do
- Affects up to 2.4.37. Update Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-48122 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows SQL Injection.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.
- Product
- Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light
- Affected
- up to 2.4.37
- What to do
- Affects up to 2.4.37. Update Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Welcart e-Commerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47511 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Path Traversal.This issue affects Welcart e-Commerce: from n/a through <= 2.11.13.
- Product
- Welcart e-Commerce
- Affected
- up to 2.11.13
- What to do
- Affects up to 2.11.13. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2025WPshop 2 – E-Commerce: Insecure Direct Object ReferenceCVE-2025-3853 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.0.0 to 2.6.0 via the callback_generate_api_key() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create valid API keys on behalf of other users.
- Product
- WPshop 2 – E-Commerce
- Affected
- 2.0.0 to 2.6.0
- What to do
- Affects 2.0.0 to 2.6.0. Update WPshop 2 – E-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 6, 2025WPshop 2 – E-Commerce: Privilege escalationCVE-2025-3852 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.0 to 2.6.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email & password through the update() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
- Product
- WPshop 2 – E-Commerce
- Affected
- 2.0.0 to 2.6.0
- What to do
- Affects 2.0.0 to 2.6.0. Update WPshop 2 – E-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 2, 2025Cross-Site Request Forgery (CSRF) vulnerability in Gosoft Software Proticaret E-Commerce allows Cross Site Request Forgery.CVE-2024-11142 · Websites & servers · Gosoft Software · reported by iletisim@usom.gov.trHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Gosoft Software Proticaret E-Commerce allows Cross Site Request Forgery. This issue affects Proticaret E-Commerce: before v6.0 NOTE: According to the vendor, fixing process is still ongoing for v4.05.
- Product
- Proticaret E-Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Apr 24, 2025Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39378 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows PHP Local File Inclusion.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.
- Product
- Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light
- Affected
- up to 2.4.37
- What to do
- Affects up to 2.4.37. Update Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Shopware is an open source e-commerce software platform.CVE-2025-32378 · Other software · shopware · reported by GitHubMedium 6.9
Shopware is an open source e-commerce software platform. Prior to 6.6.10.3 or 6.5.8.17, the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation. Default settings are Newsletter: Double Opt-in set to active, Newsletter: Double opt-in for registered customers set to disabled, and Log-in & sign-up: Double opt-in on sign-up set to disabled. With these settings, anyone can register an account on the shop using any e-mail-address and then check the check-box in the account page to sign up for the newsletter. The recipient will receive two mails confirming registering and signing up for the newsletter, no confirmation link needed to be clicked for either. In the backend the recipient is set to “instantly active”. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability.CVE-2025-27130 · Websites & servers · Welcart Inc. · reported by vultures@jpcert.or.jpHigh 8.8
Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker who can access websites created using the product.
- Product
- Welcart e-Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2025WP e-Commerce Style Email: Cross-Site Request Forgery (CSRF)CVE-2025-30615 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in Jacob Schwartz WP e-Commerce Style Email wp-e-commerce-style-email allows Code Injection.This issue affects WP e-Commerce Style Email: from n/a through <= 0.6.2.
- Product
- WP e-Commerce Style Email
- Affected
- up to 0.6.2
- What to do
- Affects up to 0.6.2. Update WP e-Commerce Style Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 4, 2025Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wind Media E-Commerce Website Template allows SQL InjectioCVE-2024-9149 · Websites & servers · Wind Media · reported by iletisim@usom.gov.trHigh 8.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wind Media E-Commerce Website Template allows SQL Injection. This issue affects E-Commerce Website Template: before v1.5.
- Product
- E-Commerce Website Template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 28, 2025Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a hCVE-2025-27400 · Websites & servers · OpenMage · reported by GitHubLow 2.9
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Versions prior to 20.12.3 and 20.13.0 contain a vulnerability that allows script execution in the admin panel which could lead to cross-site scripting against authenticated admin users. The attack requires an admin user with configuration access, so in practicality it is not very likely to be useful given that a user with this level of access is probably already a full admin. Versions 20.12.3 and 20.13.0 contain a patch for the issue.
- Product
- magento-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2025Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tekrom Technology T-Soft E-Commerce allows Cross-SiCVE-2025-0545 · Websites & servers · Tekrom Technology · reported by iletisim@usom.gov.trMedium 4.7
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tekrom Technology T-Soft E-Commerce allows Cross-Site Scripting (XSS). This issue affects T-Soft E-Commerce: before v5.
- Product
- T-Soft E-Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 12, 2025Welcart e-Commerce: Stored Cross-Site ScriptingCVE-2025-0511 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 2.11.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Welcart e-Commerce
- Affected
- up to 2.11.9
- What to do
- Affects up to 2.11.9. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 8, 2025A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0.CVE-2024-13205 · Websites & servers · kurniaramadhan · reported by VulDBMedium 5.1
A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/create_product.php of the component Create Product Page. The manipulation of the argument Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- E-Commerce-PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0.CVE-2024-13204 · Websites & servers · kurniaramadhan · reported by VulDBMedium 5.3
A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /blog-details.php. The manipulation of the argument blog_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- E-Commerce-PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0.CVE-2024-13203 · Websites & servers · kurniaramadhan · reported by VulDBMedium 6.9
A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- E-Commerce-PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2024A vulnerability was found in Codezips E-Commerce Website 1.0.CVE-2024-12884 · Websites & servers · Codezips · reported by VulDBMedium 6.9
A vulnerability was found in Codezips E-Commerce Website 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- E-Commerce Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgeochen.medium.comvuldb.com
Dec 19, 2024A vulnerability, which was classified as critical, was found in Codezips E-Commerce Site 1.0.CVE-2024-12794 · Websites & servers · Codezips · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Codezips E-Commerce Site 1.0. This affects an unknown part of the file /admin/editorder.php. The manipulation of the argument dstatus/quantity/ddate leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- E-Commerce Site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2024A vulnerability classified as critical was found in Codezips E-Commerce Site 1.0.CVE-2024-12792 · Websites & servers · Codezips · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in Codezips E-Commerce Site 1.0. Affected by this vulnerability is an unknown functionality of the file newadmin.php. The manipulation of the argument email leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- E-Commerce Site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2024A vulnerability was found in Codezips E-Commerce Site 1.0.CVE-2024-12791 · Websites & servers · Codezips · reported by VulDBMedium 6.9
A vulnerability was found in Codezips E-Commerce Site 1.0. It has been rated as critical. This issue affects some unknown processing of the file signin.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- E-Commerce Site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024WP e-Commerce Style Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52462 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob Schwartz WP e-Commerce Style Email wp-e-commerce-style-email allows Reflected XSS.This issue affects WP e-Commerce Style Email: from n/a through <= 0.6.2.
- Product
- WP e-Commerce Style Email
- Affected
- up to 0.6.2
- What to do
- Affects up to 0.6.2. Update WP e-Commerce Style Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 25, 2024A vulnerability classified as critical was found in Codezips E-Commerce Site 1.0.CVE-2024-11663 · Websites & servers · Codezips · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in Codezips E-Commerce Site 1.0. Affected by this vulnerability is an unknown functionality of the file search.php. The manipulation of the argument keywords leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- E-Commerce Site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Special Minds Design and Software e-Commerce allows SQL InCVE-2024-7882 · Websites & servers · Special Minds Design and Software · reported by iletisim@usom.gov.trMedium 6.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Special Minds Design and Software e-Commerce allows SQL Injection. This issue affects e-Commerce: before 22.11.2024.
- Product
- e-Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Oct 24, 2024Aimeos is an e-commerce framework.CVE-2024-47173 · Other software · aimeos · reported by GitHubMedium 5.5
Aimeos is an e-commerce framework. All SaaS and marketplace setups using the Aimeos GraphQL API admin interface version from 2024.04 up to 2024.07.1 are affected by a potential denial of service attack. Version 2024.07.2 fixes the issue.
- Product
- ai-admin-graphql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2024aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects.CVE-2024-39319 · Other software · aimeos · reported by GitHubMedium 5.3
aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. Prior to versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, an insecure direct object reference allows an attacker to disable subscriptions and reviews of another customer. Versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.
- Product
- ai-controller-frontend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2024Welcart e-Commerce prior to 2.11.2 contains a cross-site scripting vulnerability.CVE-2024-45366 · Websites & servers · Welcart Inc. · reported by vultures@jpcert.or.jpMedium 6.1
Welcart e-Commerce prior to 2.11.2 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the user's web browser.
- Product
- Welcart e-Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2024SQL injection vulnerability in Welcart e-Commerce prior to 2.11.2 allows an attacker who can login to the product to obtain or alter the information stored in tCVE-2024-42404 · Websites & servers · Welcart Inc. · reported by vultures@jpcert.or.jpHigh 8.8
SQL injection vulnerability in Welcart e-Commerce prior to 2.11.2 allows an attacker who can login to the product to obtain or alter the information stored in the database.
- Product
- Welcart e-Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2024aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks.CVE-2024-39322 · Other software · aimeos · reported by GitHubMedium 5.5
aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks. In versions prior to 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2, improper access control allows editors to remove admin group and locale configuration in the Aimeos backend. Versions 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2 contain a fix for the issue.
- Product
- ai-admin-jsonadm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2024ai-client-html is an Aimeos e-commerce HTML client component.CVE-2024-38516 · Other software · aimeos · reported by GitHubHigh 8.8
ai-client-html is an Aimeos e-commerce HTML client component. Debug information revealed sensitive information from environment variables in error log. This issue has been patched in versions 2024.04.7, 2023.10.15, 2022.10.13 and 2021.10.22.
- Product
- ai-client-html
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2024WooCommerce is an open-source e-commerce platform built on WordPress.CVE-2024-37297 · WordPress plugins & themes · reported by GitHubMedium 5.4
WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site scripting. A bad actor can manipulate a link to include malicious HTML & JavaScript content. While the content is not saved to the database, the links may be sent to victims for malicious purposes. The injected JavaScript could hijack content & data stored in the browser, including the session. The URL content is read through the `Sourcebuster.js` library and then inserted without proper sanitization to the classic checkout and registration forms. Versions 8.8.5 and 8.9.3 contain a patch for the issue. As a workaround, one may disable the Order Attribution feature.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recorddeveloper.woocommerce.comgithub.com
Jun 11, 2024Welcart e-Commerce: Missing AuthorizationCVE-2024-32144 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Welcart Inc. Welcart e-Commerce.This issue affects Welcart e-Commerce: from n/a through 2.9.14.
- Product
- Welcart e-Commerce
- Affected
- up to 2.9.14
- What to do
- Affects up to 2.9.14. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 11, 2024The Aimeos HTML client provides Aimeos HTML components for e-commerce projects.CVE-2024-37296 · Other software · aimeos · reported by GitHubMedium 5.3
The Aimeos HTML client provides Aimeos HTML components for e-commerce projects. Starting in version 2020.04.1 and prior to versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5, digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn't succeed. Versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5 fix this issue.
- Product
- ai-client-html
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2024Aimeos is an Open Source e-commerce framework for online shops.CVE-2024-37295 · Other software · aimeos · reported by GitHubHigh 7.2
Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version 2024.04.5 fixes the issue.
- Product
- aimeos-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2024Aimeos is an Open Source e-commerce framework for online shops.CVE-2024-37294 · Other software · aimeos · reported by GitHubMedium 5.5
Aimeos is an Open Source e-commerce framework for online shops. All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack. Users should upgrade to versions 2022.10.17, 2023.10.17, or 2024.04 of the aimeos/aimeos-core package to receive a patch.
- Product
- aimeos-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2024A vulnerability, which was classified as critical, has been found in Codezips E-Commerce Site 1.0.CVE-2024-5049 · Websites & servers · Codezips · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Codezips E-Commerce Site 1.0. Affected by this issue is some unknown functionality of the file admin/editproduct.php. The manipulation of the argument profilepic leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-264746 is the identifier assigned to this vulnerability.
- Product
- E-Commerce Site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2024A vulnerability has been found in Codezips E-Commerce Site 1.0 and classified as critical.CVE-2024-4923 · Websites & servers · Codezips · reported by VulDBMedium 5.3
A vulnerability has been found in Codezips E-Commerce Site 1.0 and classified as critical. This vulnerability affects unknown code of the file admin/addproduct.php. The manipulation of the argument profilepic leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264460.
- Product
- E-Commerce Site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024The T-Soft E-Commerce 4 web application is susceptible to SQL injection (SQLi) attacks when authenticated as an admin or privileged user.CVE-2022-28132 · Websites & servers · t-soft · reported by MITREHigh 7.2
The T-Soft E-Commerce 4 web application is susceptible to SQL injection (SQLi) attacks when authenticated as an admin or privileged user. This vulnerability allows attackers to access and manipulate the database through crafted requests. By exploiting this flaw, attackers can bypass authentication mechanisms, view sensitive information stored in the database, and potentially exfiltrate data.
- Product
- e-commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
May 14, 2024PrestaShop is an open source e-commerce web application.CVE-2024-34717 · Websites & servers · PrestaShop · reported by GitHubMedium 5.3
PrestaShop is an open source e-commerce web application. In PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random secure_key parameter in the url. This issue is patched in version 8.1.6. No known workarounds are available.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024PrestaShop is an open source e-commerce web application.CVE-2024-34716 · Websites & servers · PrestaShop · reported by GitHubCritical 9.6
PrestaShop is an open source e-commerce web application. A cross-site scripting (XSS) vulnerability that only affects PrestaShops with customer-thread feature flag enabled is present starting from PrestaShop 8.1.0 and prior to PrestaShop 8.1.6. When the customer thread feature flag is enabled through the front-office contact form, a hacker can upload a malicious file containing an XSS that will be executed when an admin opens the attached file in back office. The script injected can access the session and the security token, which allows it to perform any authenticated action in the scope of the administrator's right. This vulnerability is patched in 8.1.6. A workaround is to disable the customer-thread feature-flag.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.