Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
240 results · page 5 of 5
Sep 1, 2004CRLF injection vulnerability in Comersus Shopping Cart 5.0991 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML contentCVE-2004-1656 · Other software · Comersus Open Technologies · reported by MITREMedium 5
CRLF injection vulnerability in Comersus Shopping Cart 5.0991 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the redirecturl parameter.
- Product
- Comersus Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Aug 6, 2004Cross-site scripting (XSS) vulnerability in (1) cart32.exe or (2) c32web.exe in Cart32 shopping cart allows remote attackers to execute arbitrary web script viaCVE-2004-0675 · Other software · Mcmurtrey Whitaker And Associates · reported by MITREMedium 6.8
Cross-site scripting (XSS) vulnerability in (1) cart32.exe or (2) c32web.exe in Cart32 shopping cart allows remote attackers to execute arbitrary web script via the cart32 parameter to a GetLatestBuilds command.
- Product
- Cart32
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrponidi.5u.commarc.info
Dec 31, 2003cart.pl in Dansie shopping cart allows remote attackers to obtain the installation path via an invalid db parameter, which leaks the path in an error message.CVE-2003-1517 · Other software · Dansie · reported by MITREMedium 5
cart.pl in Dansie shopping cart allows remote attackers to obtain the installation path via an invalid db parameter, which leaks the path in an error message.
- Product
- Shopping Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuriteam.comsecurityfocus.com
Sep 17, 2003Per Magne Knutsen's CartMan shopping cart (cartman.php) 1.04 and earlier allows remote attackers to modify product prices by changing the price parameter.CVE-2002-1352 · Other software · PER Magne Knutsen · reported by MITREMedium 5
Per Magne Knutsen's CartMan shopping cart (cartman.php) 1.04 and earlier allows remote attackers to modify product prices by changing the price parameter.
- Product
- Cartman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comidefense.com
Dec 31, 20023D3.Com ShopFactory 5.8 uses client-side encryption and decryption for sensitive price data, which allows remote attackers to modify shopping cart prices by usiCVE-2002-2303 · Other software · 3d3.com · reported by MITREHigh 7.8
3D3.Com ShopFactory 5.8 uses client-side encryption and decryption for sensitive price data, which allows remote attackers to modify shopping cart prices by using the Javascript to decrypt the cookie that contains the data.
- Product
- Shopfactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.uni-stuttgart.desecurityreason.com
Dec 31, 20023D3.Com ShopFactory 5.5 through 5.8 allows remote attackers to modify the prices in their shopping carts by modifying the price in a hidden form field.CVE-2002-2302 · Other software · 3d3.com · reported by MITREMedium 6.4
3D3.Com ShopFactory 5.5 through 5.8 allows remote attackers to modify the prices in their shopping carts by modifying the price in a hidden form field.
- Product
- Shopfactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comcert.uni-stuttgart.de
Jul 3, 2002Cross-site scripting vulnerability in SunShop 2.5 and earlier allows remote attackers to gain administrative privileges to SunShop by injecting the script into CVE-2002-0553 · Other software · Turnkey Solutions · reported by MITREHigh 7.5
Cross-site scripting vulnerability in SunShop 2.5 and earlier allows remote attackers to gain administrative privileges to SunShop by injecting the script into fields during new customer registration.
- Product
- Sunshop Shopping Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comiss.net
Sep 8, 2001shop.pl in Hassan Consulting Shopping Cart 1.23 allows remote attackers to execute arbitrary commands via shell metacharacters in the "page" parameter.CVE-2001-0985 · Other software · Hassan Consulting · reported by MITREHigh 7.5
shop.pl in Hassan Consulting Shopping Cart 1.23 allows remote attackers to execute arbitrary commands via shell metacharacters in the "page" parameter.
- Product
- Shopping Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordirata.comsecurityfocus.com
Sep 5, 2001shopplus.cgi in ShopPlus shopping cart allows remote attackers to execute arbitrary commands via shell metacharacters in the "file" parameter.CVE-2001-0992 · Other software · Kabotie Software Technologies · reported by MITREHigh 7.5
shopplus.cgi in ShopPlus shopping cart allows remote attackers to execute arbitrary commands via shell metacharacters in the "file" parameter.
- Product
- Shopplus Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comexchange.xforce.ibmcloud.com
Jan 9, 2001Directory traversal vulnerability in Quikstore shopping cart program allows remote attackers to read arbitrary files via a ..CVE-2000-1188 · Other software · I-soft · reported by MITREMedium 5
Directory traversal vulnerability in Quikstore shopping cart program allows remote attackers to read arbitrary files via a .. (dot dot) attack in the "page" parameter.
- Product
- Quikstore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comarchives.neohapsis.com
Dec 31, 2000Privacy leak in Dansie Shopping Cart 3.04, and probably earlier versions, sends sensitive information such as user credentials to an e-mail address controlled bCVE-2000-1243 · Other software · Dansie · reported by MITREMedium 5
Privacy leak in Dansie Shopping Cart 3.04, and probably earlier versions, sends sensitive information such as user credentials to an e-mail address controlled by the product developers.
- Product
- Shopping Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comarchives.neohapsis.com
Dec 19, 2000Directory traversal vulnerability in Bytes Interactive Web Shopper shopping cart program (shopper.cgi) 2.0 and earlier allows remote attackers to read arbitraryCVE-2000-0922 · Other software · Bytes Interactive · reported by MITREMedium 5
Directory traversal vulnerability in Bytes Interactive Web Shopper shopping cart program (shopper.cgi) 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack on the newpage parameter.
- Product
- Web Shopper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Dec 19, 2000Directory traversal vulnerability in Hassan Consulting shop.cgi shopping cart program allows remote attackers to read arbitrary files via a ..CVE-2000-0921 · Other software · Hassan Consulting · reported by MITREMedium 5
Directory traversal vulnerability in Hassan Consulting shop.cgi shopping cart program allows remote attackers to read arbitrary files via a .. (dot dot) attack on the page parameter.
- Product
- Shopping Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org
Dec 19, 2000The default installation of SmartWin CyberOffice Shopping Cart 2 (aka CyberShop) installs the _private directory with world readable permissions, which allows rCVE-2000-0925 · Other software · Smartwin Technology · reported by MITREMedium 5
The default installation of SmartWin CyberOffice Shopping Cart 2 (aka CyberShop) installs the _private directory with world readable permissions, which allows remote attackers to obtain sensitive information.
- Product
- Cyberoffice Shopping Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.commarc.info
Dec 19, 2000SmartWin CyberOffice Shopping Cart 2 (aka CyberShop) allows remote attackers to modify price information by changing the "Price" hidden form variable.CVE-2000-0926 · Other software · Smartwin Technology · reported by MITREHigh 7.5
SmartWin CyberOffice Shopping Cart 2 (aka CyberShop) allows remote attackers to modify price information by changing the "Price" hidden form variable.
- Product
- Cyberoffice Shopping Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.commarc.info
Nov 20, 2000quikstore.cgi in Quikstore Shopping Cart allows remote attackers to execute arbitrary commands via shell metacharacters in the URL portion of an HTTP GET requesCVE-2000-1223 · Other software · I-soft · reported by MITREHigh 7.5
quikstore.cgi in Quikstore Shopping Cart allows remote attackers to execute arbitrary commands via shell metacharacters in the URL portion of an HTTP GET request.
- Product
- Quikstore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Jul 10, 2000The view_page.html sample page in the MiniVend shopping cart program allows remote attackers to execute arbitrary commands via shell metacharacters.CVE-2000-0635 · Other software · Akopia · reported by MITREHigh 7.5
The view_page.html sample page in the MiniVend shopping cart program allows remote attackers to execute arbitrary commands via shell metacharacters.
- Product
- Minivend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
May 24, 2000The add.exe program in the Carello shopping cart software allows remote attackers to duplicate files on the server, which could allow the attacker to read sourcCVE-2000-0396 · Other software · Pacific Software · reported by MITREMedium 5
The add.exe program in the Carello shopping cart software allows remote attackers to duplicate files on the server, which could allow the attacker to read source code for web scripts such as .ASP files.
- Product
- Carello
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
May 1, 2000Buffer overflows in redirect.exe and changepw.exe in PDGSoft shopping cart allow remote attackers to execute arbitrary commands via a long query string.CVE-2000-0401 · Other software · Pdgsoft · reported by MITREHigh 7.5
Buffer overflows in redirect.exe and changepw.exe in PDGSoft shopping cart allow remote attackers to execute arbitrary commands via a long query string.
- Product
- PDG Shopping Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2000The dansie shopping cart application cart.pl allows remote attackers to obtain the shopping cart database and configuration information via a URL that referenceCVE-2000-0254 · Other software · Craig Dansie · reported by MITREMedium 5
The dansie shopping cart application cart.pl allows remote attackers to obtain the shopping cart database and configuration information via a URL that references either the env, db, or vars form variables.
- Product
- Dansie Shopping Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Apr 12, 2000TalentSoft webpsvr daemon in the Web+ shopping cart application allows remote attackers to read arbitrary files via a ..CVE-2000-0282 · Other software · Talentsoft · reported by MITREMedium 5
TalentSoft webpsvr daemon in the Web+ shopping cart application allows remote attackers to read arbitrary files via a .. (dot dot) attack on the webplus CGI program.
- Product
- Web+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.talentsoft.comarchives.neohapsis.com
Apr 11, 2000The dansie shopping cart application cart.pl allows remote attackers to execute commands via a shell metacharacters in a form variable.CVE-2000-0252 · Other software · Craig Dansie · reported by MITREMedium 5
The dansie shopping cart application cart.pl allows remote attackers to execute commands via a shell metacharacters in a form variable.
- Product
- Dansie Shopping Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Apr 11, 2000The dansie shopping cart application cart.pl allows remote attackers to modify sensitive purchase information via hidden form fields.CVE-2000-0253 · Other software · Craig Dansie · reported by MITREHigh 10
The dansie shopping cart application cart.pl allows remote attackers to modify sensitive purchase information via hidden form fields.
- Product
- Dansie Shopping Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Feb 1, 2000The Intellivend shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.CVE-2000-0108 · Other software · Intelligent Vending Systems · reported by MITREHigh 7.5
The Intellivend shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.
- Product
- Intellivend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Feb 1, 2000The CartIt shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.CVE-2000-0137 · Other software · Cartit · reported by MITREHigh 7.5
The CartIt shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.
- Product
- Cartit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Feb 1, 2000The Check It Out shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.CVE-2000-0134 · Other software · Adgrafix Corporation · reported by MITREHigh 7.5
The Check It Out shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.
- Product
- Check IT OUT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Feb 1, 2000The shopping cart application provided with Filemaker allows remote users to modify sensitive purchase information via hidden form fields.CVE-2000-0123 · Other software · Filemaker · reported by MITREHigh 7.5
The shopping cart application provided with Filemaker allows remote users to modify sensitive purchase information via hidden form fields.
- Product
- Filemaker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Feb 1, 2000The EasyCart shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.CVE-2000-0106 · Other software · Easycart · reported by MITREHigh 7.5
The EasyCart shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.
- Product
- Easycart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Feb 1, 2000The Shoptron shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.CVE-2000-0104 · Other software · Web Express · reported by MITREHigh 7.5
The Shoptron shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.
- Product
- Shoptron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Feb 1, 2000The SmartCart shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.CVE-2000-0103 · Other software · Netsmart · reported by MITREHigh 7.5
The SmartCart shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.
- Product
- Smartcart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Feb 1, 2000The SalesCart shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.CVE-2000-0102 · Other software · Salescart · reported by MITREHigh 7.5
The SalesCart shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.
- Product
- Salescart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Feb 1, 2000The Make-a-Store OrderPage shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.CVE-2000-0101 · Other software · Make-a-store · reported by MITREHigh 7.5
The Make-a-Store OrderPage shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.
- Product
- Orderpage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Feb 1, 2000The WebSiteTool shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.CVE-2000-0110 · Other software · Baron Consulting Group · reported by MITREHigh 7.5
The WebSiteTool shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.
- Product
- Websitetool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Feb 1, 2000The Cart32 shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.CVE-2000-0136 · Other software · Mcmurtrey Whitaker And Associates · reported by MITREHigh 7.5
The Cart32 shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.
- Product
- Cart32
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Feb 1, 2000The @Retail shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.CVE-2000-0135 · Other software · Atretail · reported by MITREHigh 7.5
The @Retail shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.
- Product
- Atretail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Apr 20, 1999An incorrect configuration of the WebStore 1.0 shopping cart CGI program "web_store.cgi" could disclose private information.CVE-1999-0604 · Other software · Selena SOL · reported by MITREMedium 5
An incorrect configuration of the WebStore 1.0 shopping cart CGI program "web_store.cgi" could disclose private information.
- Product
- Selena SOL Webstore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 1999quikstore.cgi in QuikStore shopping cart stores quikstore.cfg under the web document root with insufficient access control, which allows remote attackers to obtCVE-1999-0607 · Other software · I-soft · reported by MITREMedium 5
quikstore.cgi in QuikStore shopping cart stores quikstore.cfg under the web document root with insufficient access control, which allows remote attackers to obtain the cleartext administrator password and gain privileges.
- Product
- Quikstore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 1999An incorrect configuration of the PDG Shopping Cart CGI program "shopper.cgi" could disclose private information.CVE-1999-0608 · Other software · Pdgsoft · reported by MITREMedium 5
An incorrect configuration of the PDG Shopping Cart CGI program "shopper.cgi" could disclose private information.
- Product
- PDG Shopping Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 1999An incorrect configuration of the Order Form 1.0 shopping cart CGI program could disclose private information.CVE-1999-0605 · Other software · Austin Contract Computing · reported by MITREMedium 5
An incorrect configuration of the Order Form 1.0 shopping cart CGI program could disclose private information.
- Product
- Merchant Order Form
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 1999An incorrect configuration of the EZMall 2000 shopping cart CGI program "mall2000.cgi" could disclose private information.CVE-1999-0606 · Other software · Seaside Enterprises · reported by MITREMedium 5
An incorrect configuration of the EZMall 2000 shopping cart CGI program "mall2000.cgi" could disclose private information.
- Product
- Ezmall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.