Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
295 results · page 5 of 6
Mar 18, 2023An issue was discovered in Alphaware - Simple E-Commerce System v1.0.CVE-2023-26905 · Websites & servers · Alphaware - Simple E-commerce System Project · reported by MITRECritical 9.8
An issue was discovered in Alphaware - Simple E-Commerce System v1.0. There is a SQL injection that can directly issue instructions to the background database system via /alphaware/details.php?id.
- Product
- Alphaware - Simple E-commerce System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2023E-Commerce System v1.0 ws discovered to contain a SQL injection vulnerability via the id parameter at /admin/delete_user.php.CVE-2023-27052 · Other software · Moosikay Project · reported by MITRECritical 9.8
E-Commerce System v1.0 ws discovered to contain a SQL injection vulnerability via the id parameter at /admin/delete_user.php.
- Product
- Moosikay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2023PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF).CVE-2023-25170 · Websites & servers · PrestaShop · reported by GitHubMedium 5
PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). When authenticating users, PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enable same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. The problem is fixed in version 8.0.1.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023The PrestaShop e-commerce platform module stripejs contains a Blind SQL injection vulnerability up to version 4.5.5.CVE-2023-23315 · Other software · Stripe · reported by MITRECritical 9.8
The PrestaShop e-commerce platform module stripejs contains a Blind SQL injection vulnerability up to version 4.5.5. The method `stripejsValidationModuleFrontController::initContent()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
- Product
- Stripe Payment Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
Jan 27, 2023OpenMage LTS is an e-commerce platform.CVE-2023-23617 · Websites & servers · OpenMage · reported by GitHubMedium 4.9
OpenMage LTS is an e-commerce platform. Versions prior to 19.4.22 and 20.0.19 contain an infinite loop in malicious code filter in certain conditions. Versions 19.4.22 and 20.0.19 have a fix for this issue. There are no known workarounds.
- Product
- magento-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2023OpenMage LTS is an e-commerce platform.CVE-2021-41231 · Websites & servers · OpenMage · reported by GitHubHigh 7.2
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, an administrator with the permissions to upload files via DataFlow and to create products was able to execute arbitrary code via the convert profile. Versions 19.4.22 and 20.0.19 contain a patch for this issue.
- Product
- magento-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2023OpenMage LTS is an e-commerce platform.CVE-2021-41144 · Websites & servers · OpenMage · reported by GitHubHigh 8.8
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, a layout block was able to bypass the block blacklist to execute remote code. Versions 19.4.22 and 20.0.19 contain a patch for this issue.
- Product
- magento-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2023OpenMage LTS is an e-commerce platform.CVE-2021-41143 · Websites & servers · OpenMage · reported by GitHubHigh 7.2
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could execute code on the server. Versions 19.4.22 and 20.0.19 contain a patch for this issue.
- Product
- magento-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2023OpenMage LTS is an e-commerce platform.CVE-2021-39217 · Websites & servers · OpenMage · reported by GitHubHigh 7.2
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Custom Layout enabled admin users to execute arbitrary commands via block methods. Versions 19.4.22 and 20.0.19 contain patches for this issue.
- Product
- magento-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023Welcart e-Commerce: Does not validate and escapes one of its shortcode attributesCVE-2022-4655 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Welcart e-Commerce WordPress plugin before 2.8.9 does not validate and escapes one of its shortcode attributes, which could allow users with a role as low as a contributor to perform a Stored Cross-Site Scripting attack.
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.9
- What to do
- Update Welcart e-Commerce to 2.8.9 or newer.
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated usersCVE-2022-4237 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to perform PHAR deserialisation when they can upload a file and a suitable gadget chain is present on the blog
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.6
- What to do
- Update Welcart e-Commerce to 2.8.6 or newer.
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated usersCVE-2022-4236 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server.
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.5
- What to do
- Update Welcart e-Commerce to 2.8.5 or newer.
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it to output the content of a fileCVE-2022-4140 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.5
- What to do
- Update Welcart e-Commerce to 2.8.5 or newer.
Dec 12, 2022Welcart e-Commerce: Does not have authorisation and CSRF in an AJAX actionCVE-2022-3946 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and delete shipping methods.
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.4
- What to do
- Update Welcart e-Commerce to 2.8.4 or newer.
Dec 12, 2022Welcart e-Commerce: Does not sanitise and escape some parametersCVE-2022-3935 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.4
- What to do
- Update Welcart e-Commerce to 2.8.4 or newer.
Dec 8, 2022PrestaShop is an open-source e-commerce solution.CVE-2022-46158 · Websites & servers · PrestaShop · reported by GitHubMedium 5.3
PrestaShop is an open-source e-commerce solution. Versions prior to 1.7.8.8 did not properly restrict host filesystem access for users. Users may have been able to view the contents of the upload directory without appropriate permissions. This issue has been addressed and users are advised to upgrade to version 1.7.8.8. There are no known workarounds for this issue.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022Shopware is an open source e-commerce software.CVE-2022-36102 · Other software · shopware · reported by GitHubMedium 6.3
Shopware is an open source e-commerce software. In affected versions if backend admin controllers are called with a certain notation, the ACL could be bypassed. Users could execute actions, which they are normally not able to do. Users are advised to update to the current version (5.7.15). Users can get the update via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Sep 12, 2022Shopware is an open source e-commerce software.CVE-2022-36101 · Other software · shopware · reported by GitHubMedium 5.4
Shopware is an open source e-commerce software. In affected versions the request for the customer detail view in the backend administration contained sensitive data like the hashed password and the session ID. These fields are now explicitly unset in version 5.7.15. Users are advised to update and may get the update either via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Aug 1, 2022PrestaShop is an Open Source e-commerce platform.CVE-2022-31181 · Websites & servers · PrestaShop · reported by GitHubCritical 9.8
PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which can be chained to call PHP's Eval function on attacker input. The problem is fixed in version 1.7.8.7. Users are advised to upgrade. Users unable to upgrade may delete the MySQL Smarty cache feature.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2022Shopware is an open source e-commerce software.CVE-2022-31148 · Other software · shopware · reported by GitHubMedium 5.4
Shopware is an open source e-commerce software. In versions from 5.7.0 a persistent cross site scripting (XSS) vulnerability exists in the customer module. Users are recommend to update to the current version 5.7.14. You can get the update to 5.7.14 regularly via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Jun 27, 2022Shopware is an open source e-commerce software made in Germany.CVE-2022-31057 · Other software · shopware · reported by GitHubMedium 6.5
Shopware is an open source e-commerce software made in Germany. Versions of Shopware 5 prior to version 5.7.12 are subject to an authenticated Stored XSS in Administration. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Jun 1, 2022solidus_backend is the admin interface for the Solidus e-commerce framework.CVE-2022-31000 · Other software · solidusio · reported by GitHubLow 2.3
solidus_backend is the admin interface for the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 contain a cross-site request forgery (CSRF) vulnerability. The vulnerability allows attackers to change the state of an order's adjustments if they hold its number, and the execution happens on a store administrator's computer. Users should upgrade to solidus_backend 3.1.6, 3.0.6, or 2.11.16 to receive a patch.
- Product
- solidus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2022A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add_product of E-Commerce Website v1.0 allows attackers to execute arbitrary web scripts oCVE-2022-27330 · Websites & servers · E-commerce Website Project · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add_product of E-Commerce Website v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Title text field.
- Product
- E-commerce Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022Shopware is an open source e-commerce software platform.CVE-2022-24892 · Other software · shopware · reported by GitHubMedium 6.4
Shopware is an open source e-commerce software platform. Starting with version 5.0.4 and before version 5.7.9, multiple tokens for password reset can be requested. All tokens can be used to change the password. This makes it possible for an attacker to take over the victim's account if they somehow gain access to the victims email account and find an unused password reset token in the emails. This issue is fixed in version 5.7.9.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Apr 28, 2022Shopware is an open source e-commerce software platform.CVE-2022-24879 · Other software · shopware · reported by GitHubHigh 7.5
Shopware is an open source e-commerce software platform. Versions prior to 5.7.9 are vulnerable to malfunction of cross-site request forgery (CSRF) token validation. Under certain circumstances, the CSRF tokens were not generated anew and not validated correctly. This issue is fixed in version 5.7.9. Users of older versions may attempt to mitigate the vulnerability by using the Shopware security plugin.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Apr 28, 2022Shopware is an open source e-commerce software platform.CVE-2022-24873 · Other software · shopware · reported by GitHubMedium 5.4
Shopware is an open source e-commerce software platform. Prior to version 5.7.9, Shopware is vulnerable to non-stored cross-site scripting in the storefront. This issue is fixed in version 5.7.9. Users of older versions may attempt to mitigate the vulnerability by using the Shopware security plugin.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Jan 26, 2022PrestaShop is an Open Source e-commerce platform.CVE-2022-21686 · Websites & servers · PrestaShop · reported by GitHubCritical 9
PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2022Shopware is an open source e-commerce software platform.CVE-2022-21652 · Other software · shopware · reported by GitHubLow 3.5
Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. With version 5.7.7 the session validation was adjusted, so that sessions created prior to the latest password change of a customer account can't be used to login with said account. This also means, that upon a password change, all existing sessions for a given customer account are automatically considered invalid. There is no workaround for this issue.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Jan 5, 2022Shopware is an open source e-commerce software platform.CVE-2022-21651 · Other software · shopware · reported by GitHubMedium 6.8
Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. Users may be arbitrary redirected due to incomplete URL handling in the shopware router. This issue has been resolved in version 5.7.7. There is no workaround and users are advised to upgrade as soon as possible.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Dec 20, 2021`solidus_frontend` is the cart and storefront for the Solidus e-commerce project.CVE-2021-43846 · Other software · solidusio · reported by GitHubMedium 5.3
`solidus_frontend` is the cart and storefront for the Solidus e-commerce project. Versions of `solidus_frontend` prior to 3.1.5, 3.0.5, and 2.11.14 contain a cross-site request forgery (CSRF) vulnerability that allows a malicious site to add an item to the user's cart without their knowledge. Versions 3.1.5, 3.0.5, and 2.11.14 contain a patch for this issue. The patch adds CSRF token verification to the "Add to cart" action. Adding forgery protection to a form that missed it can have some side effects. Other CSRF protection strategies as well as a workaround involving modifcation to config/application.rb` are available. More details on these mitigations are available in the GitHub Security Advisory.
- Product
- solidus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2021PrestaShop is an Open Source e-commerce web application.CVE-2021-43789 · Websites & servers · PrestaShop · reported by GitHubHigh 7.5
PrestaShop is an Open Source e-commerce web application. Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection using search filters with `orderBy` and `sortOrder` parameters. The problem is fixed in version 1.7.8.2.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2021EC Cloud E-Commerce System v1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add admin accounts via /admiCVE-2020-21139 · Websites & servers · EC Cloud E-commerce System Project · reported by MITREMedium 6.5
EC Cloud E-Commerce System v1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add admin accounts via /admin.html?do=user&act=add.
- Product
- EC Cloud E-commerce System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2021Shopware is open source e-commerce software.CVE-2021-41188 · Other software · shopware · reported by GitHubMedium 5.7
Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the security plugin or adding a particular following config to the `.htaccess` file will protect against cross-site scripting in this case. There is also a config for those using nginx as a server. The plugin and the configs can be found on the GitHub Security Advisory page for this vulnerability.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Jun 21, 2021Cross-site scripting vulnerability in Welcart e-Commerce versions prior to 2.2.4 allows remote attackers to inject arbitrary script or HTML via unspecified vectCVE-2021-20734 · Websites & servers · Collne Inc. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Welcart e-Commerce versions prior to 2.2.4 allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
- Product
- Welcart e-Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2021PrestaShop is a fully scalable open source e-commerce solution.CVE-2021-21398 · Websites & servers · PrestaShop · reported by GitHubMedium 5.4
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.7.3, an attacker can inject HTML when the Grid Column Type DataColumn is badly used. The problem is fixed in 1.7.7.3
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2021index.jsp in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a Stored cross-site scripting (XSS) vulnerabilityCVE-2021-28126 · Websites & servers · Compassplus · reported by MITREMedium 6.1
index.jsp in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a Stored cross-site scripting (XSS) vulnerability
- Product
- Tranzware E-commerce Payment Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Mar 19, 2021/exec in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a vulnerability in its XML parser.CVE-2021-28110 · Websites & servers · Compassplus · reported by MITREHigh 7.5
/exec in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a vulnerability in its XML parser.
- Product
- Tranzware E-commerce Payment Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Mar 16, 2021The aimeos (aka Aimeos shop and e-commerce framework) extension before 19.10.12 and 20.x before 20.10.5 for TYPO3 allows XSS via a backend user account.CVE-2021-28380 · Other software · Aimeos Project · reported by MITREMedium 5.4
The aimeos (aka Aimeos shop and e-commerce framework) extension before 19.10.12 and 20.x before 20.10.5 for TYPO3 allows XSS via a backend user account.
- Product
- Aimeos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2021PrestaShop is a fully scalable open source e-commerce solution.CVE-2021-21308 · Websites & servers · PrestaShop · reported by GitHubMedium 6.1
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 the soft logout system is not complete and an attacker is able to foreign request and executes customer commands. The problem is fixed in 1.7.7.2
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2021PrestaShop is a fully scalable open source e-commerce solution.CVE-2021-21302 · Websites & servers · PrestaShop · reported by GitHubMedium 6.8
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Injection vulnerability possible by using shop search keywords via the admin panel. The problem is fixed in 1.7.7.2
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2020Spree is a complete open source e-commerce solution built with Ruby on Rails.CVE-2020-26223 · Other software · spree · reported by GitHubHigh 7.7
Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token. This is patched in versions 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected.
- Product
- spree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2020The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usces_unserialize.CVE-2020-28339 · WordPress plugins & themes · reported by MITREHigh 7.5
The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usces_unserialize. There is not a complete POP chain.
- Product
- usc-e-shop (aka Collne Welcart e-Commerce)
- Fixed in
- 1.9.36
- What to do
- Update usc-e-shop (aka Collne Welcart e-Commerce) to 1.9.36 or newer.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jan 15, 2020Yopify, an e-commerce notification plugin, up to April 06, 2017, leaks the first name, last initial, city, and recent purchase data of customers, all without usCVE-2017-3211 · Other software · Centire · reported by cret@cert.orgMedium 5.3
Yopify, an e-commerce notification plugin, up to April 06, 2017, leaks the first name, last initial, city, and recent purchase data of customers, all without user authorization.
- Product
- Yopify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.rapid7.comblog.rapid7.com
Dec 27, 2019Multiple cross-site scripting (XSS) vulnerabilities in test-plugin.php in the Swipe Checkout for WP e-Commerce plugin 3.1.0 and earlier for WordPress allow remoCVE-2014-4559 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in test-plugin.php in the Swipe Checkout for WP e-Commerce plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) api_key, (2) payment_page_url, (3) merchant_id, (4) api_url, or (5) currency parameter.
- Product
- Swipe Checkout for WP e-Commerce
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Swipe Checkout for WP e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Aug 26, 2019laracom (aka Laravel FREE E-Commerce Software) 1.4.11 has search?q= XSS.CVE-2019-15489 · Other software · Laracom · reported by MITREMedium 6.1
laracom (aka Laravel FREE E-Commerce Software) 1.4.11 has search?q= XSS.
- Product
- Laracom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2019An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to zerCVE-2019-0308 · Websites & servers · SAP SE · reported by cna@sap.comMedium 6.8
An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to zero and also checkout, by injecting an HTML code in the application that will be executed whenever the victim logs in to the application even on a different machine, leading to Code Injection.
- Product
- SAP E-Commerce (Business-to-Consumer application)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
May 14, 2019SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.CVE-2019-0298 · Websites & servers · SAP SE · reported by cna@sap.comMedium 6.1
SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Fixed in the following components SAP-CRMJAV SAP-CRMWEB SAP-SHRWEB SAP-SHRJAV SAP-CRMAPP SAP-SHRAPP, versions 7.30, 7.31, 7.32, 7.33, 7.54.
- Product
- SAP E-Commerce (SAP-CRMJAV, SAP-CRMWEB, SAP-SHRWEB, SAP-SHRJAV, SAP-CRMAPP, SAP-SHRAPP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comlaunchpad.support.sap.com
Nov 6, 2018Busca.aspx.cs in Degrau Publicidade e Internet Plataforma de E-commerce allows SQL Injection via the busca/ URI.CVE-2018-18963 · Other software · Degraupublicidade · reported by MITRECritical 9.8
Busca.aspx.cs in Degrau Publicidade e Internet Plataforma de E-commerce allows SQL Injection via the busca/ URI.
- Product
- Degraupublicidade
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlab.insightsecurity.com.brlab.insightsecurity.com.br
Dec 13, 2017Secure E-commerce Script 2.0.1 has SQL Injection via the category.php searchmain or searchcat parameter, or the single_detail.php sid parameter.CVE-2017-17629 · Websites & servers · Secure E-commerce Script Project · reported by MITRECritical 9.8
Secure E-commerce Script 2.0.1 has SQL Injection via the category.php searchmain or searchcat parameter, or the single_detail.php sid parameter.
- Product
- Secure E-commerce Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Dec 13, 2017E-commerce MLM Software 1.0 has SQL Injection via the service_detail.php pid parameter, event_detail.php eventid parameter, or news_detail.php newid parameter.CVE-2017-17610 · Websites & servers · E-commerce MLM Software Project · reported by MITRECritical 9.8
E-commerce MLM Software 1.0 has SQL Injection via the service_detail.php pid parameter, event_detail.php eventid parameter, or news_detail.php newid parameter.
- Product
- E-commerce MLM Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.