Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
65 results · page 1 of 2
Oct 9, 2026Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, specifically in the latest demo version.CVE-2026-4264 · Websites & servers · BeeTienda · reported by cve-coordination@incibe.esMedium 5.1
Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, specifically in the latest demo version. The incident occurs due to a lack of proper sanitization of user input data in the 'search' parameter of the product list endpoint. When malicious payloads are transmitted via the 'search' parameter, they are displayed insecurely in the HTML response, allowing for the arbitrary execution of JavaScript code in the victim's browser.
- Product
- eCommerce Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-55795 · Websites & servers · craftcms · reported by GitHubMedium 6.9
Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied. An unauthenticated attacker can submit couponCode values to actionUpdateCart for the session-based cart while omitting number, preventing creation of the IP rate-limit identity and allowing unlimited automated coupon-code guessing and enumeration. This issue is fixed in versions 4.11.2 and 5.6.5.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Reflected Cross-Site Scripting (XSS) in the latest demo version of the Cradle eCommerce platform.CVE-2026-3320 · Other software · e-commerce · reported by cve-coordination@incibe.esMedium 5.1
Reflected Cross-Site Scripting (XSS) in the latest demo version of the Cradle eCommerce platform. User-controlled input is insecurely reflected in the HTML output in the endpoint /product/. Exploitation of this vulnerability would allow an attacker to execute arbitrary JavaScript code.
- Product
- Cradle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Reflected Cross-Site Scripting (XSS) in the latest demo version of the Cradle eCommerce platform.CVE-2026-3319 · Other software · e-commerce · reported by cve-coordination@incibe.esMedium 5.1
Reflected Cross-Site Scripting (XSS) in the latest demo version of the Cradle eCommerce platform. User-controlled input is insecurely reflected in the HTML output in the endpoint /collection/. Exploitation of this vulnerability would allow an attacker to execute arbitrary JavaScript code.
- Product
- Cradle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Open redirection vulnerability in the latest demo version of the Cradle eCommerce platform.CVE-2026-3318 · Websites & servers · Cradle · reported by cve-coordination@incibe.esMedium 5.3
Open redirection vulnerability in the latest demo version of the Cradle eCommerce platform. The vulnerability occurs in the login form endpoint, where the ‘returnUrl’ parameter allows redirection because the web application accepts a URL as a parameter without properly validating it. As a result, it is possible to redirect users from the legitimate website to external pages. An attacker could exploit this vulnerability to deceive users and redirect them from a trusted URL to a malicious one without their knowledge.
- Product
- e-commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-32272 · Websites & servers · craftcms · reported by GitHubHigh 8.7
Craft Commerce is an ecommerce platform for Craft CMS. In versions 5.0.0 through 5.5.4, an SQL injection vulnerability exists where the ProductQuery::hasVariant and VariantQuery::hasProduct properties bypass the input sanitization blocklist added to ElementIndexesController in a prior security fix (GHSA-2453-mppf-46cj). The blocklist only strips top-level Yii2 Query properties such as where and orderBy, but hasVariant and hasProduct pass through untouched and internally call Craft::configure() on a subquery without sanitization, re-introducing SQL injection. Any authenticated control panel user can exploit this via boolean-based blind SQL injection to extract arbitrary database contents, including security keys that enable forging admin sessions for privilege escalation. This issue has been fixed in version 5.6.0.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-32271 · Websites & servers · craftcms · reported by GitHubHigh 7.7
Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, there is an SQL injection vulnerability in the Commerce TotalRevenue widget which allows any authenticated control panel user to achieve remote code execution through a four-step exploitation chain. The attack exploits unsanitized widget settings interpolated into SQL expressions, combined with PDO's default multi-statement query support, to inject a maliciously serialized PHP object into the queue table. When the queue consumer processes the injected job, the unrestricted unserialize() call in yii2-queue instantiates a GuzzleHttp FileCookieJar gadget chain whose __destruct() method writes a PHP webshell to the server's webroot. The complete chain requires only three HTTP requests, no administrative privileges, and results in arbitrary command execution as the PHP process user, with queue processing triggered via an unauthenticated endpoint. This issue has been fixed in versions 4.10.3 and 5.5.5.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-32270 · Websites & servers · craftcms · reported by GitHubLow 1.7
Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, the PaymentsController::actionPay discloses some order data to unauthenticated users when an order number is provided and the email check fails during an anonymous payment. The JSON error response includes the serialized order object (order), which contains some sensitive fields such as customer email, shipping address, and billing address. The frontend payment flow's actionPay() retrieves orders by number before authorization is fully enforcedLoad order by number. This issue has been fixed in versions 4.11.0 and 5.6.0.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-31867 · Websites & servers · craftcms · reported by GitHubMedium 6.3
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.11.0 and 5.6.0, An Insecure Direct Object Reference (IDOR) vulnerability exists in Craft Commerce’s cart functionality that allows users to hijack any shopping cart by knowing or guessing its 32-character number. The CartController accepts a user-supplied number parameter to load and modify shopping carts. No ownership validation is performed - the code only checks if the order exists and is incomplete, not whether the requester has authorization to access it. This vulnerability enables the takeover of shopping sessions and potential exposure of PII. This vulnerability is fixed in 4.11.0 and 5.6.0.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-29177 · Websites & servers · craftcms · reported by GitHubLow 1.9
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes. This vulnerability is fixed in 4.10.2 and 5.5.3.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-29176 · Websites & servers · craftcms · reported by GitHubMedium 4.8
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, A stored XSS vulnerability exists in the Commerce Settings - Inventory Locations page. The Name field is rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript. This XSS triggers when an administrator (or user with product editing permissions) creates or edits a variant product. This vulnerability is fixed in 5.5.3.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-29175 · Websites & servers · craftcms · reported by GitHubHigh 8.6
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Stored XSS vulnerabilities exist in the Commerce Inventory page. The Product Title, Variant Title, and Variant SKU fields are rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript when any user (including administrators) views the inventory management page. This vulnerability is fixed in 5.5.3.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-29174 · Websites & servers · craftcms · reported by GitHubHigh 8.7
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Craft Commerce is vulnerable to SQL Injection in the inventory levels table data endpoint. The sort[0][direction] and sort[0][sortField] parameters are concatenated directly into an addOrderBy() clause without any validation or sanitization. An authenticated attacker with access to the Commerce Inventory section can inject arbitrary SQL queries, potentially leading to a full database compromise. This vulnerability is fixed in 5.5.3.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-29173 · Websites & servers · craftcms · reported by GitHubLow 1.9
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This vulnerability is fixed in 4.10.2 and 5.5.3.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-29172 · Websites & servers · craftcms · reported by GitHubHigh 8.7
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, Craft Commerce is vulnerable to SQL Injection in the purchasables table endpoint. The sort parameter is split by | and the first part (column name) is passed directly as an array key to orderBy() without whitelist validation. Yii2's query builder does NOT escape array keys, allowing an authenticated attacker to inject arbitrary SQL into the ORDER BY clause. This vulnerability is fixed in 4.10.2 and 5.5.3.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026EverShop is a TypeScript-first eCommerce platform.CVE-2026-28213 · Other software · evershopcommerce · reported by GitHubCritical 9.8
EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.1 fixes the issue.
- Product
- evershop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026EverShop is a TypeScript-first eCommerce platform.CVE-2026-25993 · Other software · evershopcommerce · reported by GitHubCritical 9.3
EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / request_path values—derived from the url_key stored in the database—into SQL statements via string concatenation and passes them to execute(). As a result, if a malicious string is stored in url_key , subsequent event processing modifies and executes the SQL statement, leading to a second-order SQL injection. Patched from v2.1.1.
- Product
- evershop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-25522 · Websites & servers · craftcms · reported by GitHubMedium 6.1
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Zone (Name & Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-25490 · Websites & servers · craftcms · reported by GitHubMedium 6.1
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the 'Address Line 1' field in Inventory Locations is not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-25489 · Websites & servers · craftcms · reported by GitHubMedium 6.1
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Name & Description fields in Tax Zones are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-25488 · Websites & servers · craftcms · reported by GitHubMedium 6.1
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Tax Categories (Name & Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-25487 · Websites & servers · craftcms · reported by GitHubMedium 6.1
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator's browser. This occurs because the Tax Rates 'Name' field in the Store Management section is not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-25486 · Websites & servers · craftcms · reported by GitHubMedium 6.1
Craft Commerce is an ecommerce platform for Craft CMS. From version 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Methods Name field in the Store Management section is not properly sanitized before being displayed in the admin panel. This issue has been patched in version 5.5.2.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-25485 · Websites & servers · craftcms · reported by GitHubMedium 6.2
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Categories (Name & Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-25484 · Websites & servers · craftcms · reported by GitHubMedium 4.8
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, there is a Stored XSS via Product Type names. The name is not sanitized when displayed in user permissions settings. The vulnerable input (source) is in Commerce (Product Type settings), but the sink is in CMS user permissions settings. This issue has been patched in versions 4.10.1 and 5.5.2.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-25483 · Websites & servers · craftcms · reported by GitHubMedium 6.2
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability exists in Craft Commerce’s Order Status History Message. The message is rendered using the |md filter, which permits raw HTML, enabling malicious script execution. If a user has database backup utility permissions (which do not require an elevated session), an attacker can exfiltrate the entire database, including all user credentials, customer PII, order history, and 2FA recovery codes. This issue has been patched in versions 4.10.1 and 5.5.2.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-25482 · Websites & servers · craftcms · reported by GitHubMedium 6.2
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. This issue has been patched in versions 4.10.1 and 5.5.2.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Dokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers to obtain sensitive application configuration data via direct rCVE-2025-70841 · Other software · Amcoders · reported by MITRECritical 10
Dokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers to obtain sensitive application configuration data via direct request to /script/.env file. The exposed file contains Laravel application encryption key (APP_KEY), database credentials, SMTP/SendGrid API credentials, and internal configuration parameters, enabling complete system compromise including authentication bypass via session token forgery, direct database access to all tenant data, and email infrastructure takeover. Due to the multi-tenancy architecture, this vulnerability affects all tenants in the system.
- Product
- Dokans
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netgithub.com
Jan 15, 2026Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries.CVE-2021-47763 · Websites & servers · Aimeos · reported by VulnCheckHigh 8.8
Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint.
- Product
- Aimeos Laravel ecommerce platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026Bagisto is an open source laravel eCommerce platform.CVE-2026-21451 · Other software · bagisto · reported by GitHubMedium 5.2
Bagisto is an open source laravel eCommerce platform. A stored Cross-Site Scripting (XSS) vulnerability exists in Bagisto prior to version 2.3.10 within the CMS page editor. Although the platform normally attempts to sanitize `<script>` tags, the filtering can be bypassed by manipulating the raw HTTP POST request before submission. As a result, arbitrary JavaScript can be stored in the CMS content and executed whenever the page is viewed or edited. This exposes administrators to a high-severity risk, including complete account takeover, backend hijacking, and malicious script execution. Version 2.3.10 fixes the issue.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026Bagisto is an open source laravel eCommerce platform.CVE-2026-21450 · Other software · bagisto · reported by GitHubHigh 7.3
Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type parameter, which can lead to remote code execution or another exploitation. Version 2.3.10 fixes the issue.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026Bagisto is an open source laravel eCommerce platform.CVE-2026-21449 · Other software · bagisto · reported by GitHubHigh 7.4
Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via first name and last name from a low-privilege user. Version 2.3.10 fixes the issue.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026Bagisto is an open source laravel eCommerce platform.CVE-2026-21448 · Other software · bagisto · reported by GitHubHigh 8.9
Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders any product, in the `add address` step they can inject a value to run in admin view. The issue can lead to remote code execution. Version 2.3.10 contains a patch.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026Bagisto is an open source laravel eCommerce platform.CVE-2026-21447 · Other software · bagisto · reported by GitHubHigh 7.1
Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by manipulating the order ID parameter. This exposes sensitive purchase information and enables potential fraud. Version 2.3.10 patches the issue.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026Bagisto is an open source laravel eCommerce platform.CVE-2026-21446 · Other software · bagisto · reported by GitHubHigh 8.8
Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Bagisto is an open source laravel eCommerce platform.CVE-2025-62418 · Other software · bagisto · reported by GitHubMedium 6.9
Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. This vulnerability is fixed in 2.3.8.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Bagisto is an open source laravel eCommerce platform.CVE-2025-62417 · Other software · bagisto · reported by GitHubHigh 7.1
Bagisto is an open source laravel eCommerce platform. When product data that begins with a spreadsheet formula character (for example =, +, -, or @) is accepted and later exported or saved into a CSV and opened in spreadsheet software, the spreadsheet will interpret that cell as a formula. This allows an attacker to supply a CSV field (e.g., product name) that contains a formula which may be evaluated by a victim’s spreadsheet application — potentially leading to data exfiltration and remote command execution (via older Excel exploits / OLE/cmd constructs or Excel macros). This vulnerability is fixed in 2.3.8.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Bagisto is an open source laravel eCommerce platform.CVE-2025-62416 · Other software · bagisto · reported by GitHubMedium 5.1
Bagisto is an open source laravel eCommerce platform. Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) due to unsanitized user input being processed by the server-side templating engine when rendering product descriptions. This allows an attacker with product creation privileges to inject arbitrary template expressions that are evaluated by the backend — potentially leading to Remote Code Execution (RCE) on the server. This vulnerability is fixed in 2.3.8.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Bagisto is an open source laravel eCommerce platform.CVE-2025-62415 · Other software · bagisto · reported by GitHubMedium 6.9
Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted HTML file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. This vulnerability is fixed in 2.3.8.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Bagisto is an open source laravel eCommerce platform.CVE-2025-62414 · Other software · bagisto · reported by GitHubMedium 6.9
Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature (in the admin panel) is vulnerable to Cross-Site Scripting (XSS). An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields. These payloads may later execute in the context of an admin’s browser or another user viewing the customer data, enabling session theft or admin-level actions. This vulnerability is fixed in 2.3.8.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025Maho is a free and open source ecommerce platform.CVE-2025-58449 · Other software · MahoCommerce · reported by GitHubHigh 8.7
Maho is a free and open source ecommerce platform. In Maho prior to 25.9.0, an authenticated staff user with access to the `Dashboard` and `Catalog\Manage Products` permissions can create a custom option on a listing with a file input field. By allowing file uploads with a `.php` extension, the user can use the filed to upload malicious PHP files, gaining remote code execution. Version 25.9.0 fixes the issue.
- Product
- maho
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2025CE Phoenix is a free, open-source eCommerce platform.CVE-2025-47289 · Other software · CE-PhoenixCart · reported by GitHubMedium 6.3
CE Phoenix is a free, open-source eCommerce platform. A stored cross-site scripting (XSS) vulnerability was discovered in CE Phoenix versions 1.0.9.9 through 1.1.0.2 where an attacker can inject malicious JavaScript into the testimonial description field. Once submitted, if the shop owner (admin) approves the testimonial, the script executes in the context of any user visiting the testimonial page. Because the session cookies are not marked with the `HttpOnly` flag, they can be exfiltrated by the attacker — potentially leading to account takeover. Version 1.1.0.3 fixes the issue.
- Product
- PhoenixCart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Jun 2, 2025The CE Phoenix eCommerce platform, starting in version 1.0.9.7 and prior to version 1.1.0.3, allowed logged-in users to delete their accounts without requiring CVE-2025-47272 · Other software · CE-PhoenixCart · reported by GitHubMedium 5.5
The CE Phoenix eCommerce platform, starting in version 1.0.9.7 and prior to version 1.1.0.3, allowed logged-in users to delete their accounts without requiring password re-authentication. An attacker with temporary access to an authenticated session (e.g., on a shared/public machine) could permanently delete the user’s account without knowledge of the password. This bypass of re-authentication puts users at risk of account loss and data disruption. Version 1.1.0.3 contains a patch for the issue.
- Product
- PhoenixCart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2024Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag.CVE-2024-42355 · Other software · shopware · reported by GitHubHigh 8.3
Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and allows execution of code. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Sylius is an open source eCommerce platform.CVE-2024-34349 · Other software · Sylius · reported by GitHubMedium 4.8
Sylius is an open source eCommerce platform. Prior to 1.12.16 and 1.13.1, there is a possibility to execute javascript code in the Admin panel. In order to perform an XSS attack input a script into Name field in which of the resources: Taxons, Products, Product Options or Product Variants. The code will be executed while using an autocomplete field with one of the listed entities in the Admin Panel. Also for the taxons in the category tree on the product form.The issue is fixed in versions: 1.12.16, 1.13.1.
- Product
- Sylius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2023Shoppingfeed PrestaShop is an add-on to the PrestaShop ecommerce platform to synchronize data.CVE-2023-28839 · Other software · shoppingflux · reported by GitHubCritical 9.4
Shoppingfeed PrestaShop is an add-on to the PrestaShop ecommerce platform to synchronize data. The module Shoppingfeed for PrestaShop is vulnerable to SQL injection between version 1.4.0 and 1.8.2 due to a lack of input sanitization. This issue has been addressed in version 1.8.3. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- module-prestashop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2022Sylius is an open source eCommerce platform.CVE-2022-24749 · Other software · Sylius · reported by GitHubMedium 6.1
Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting (XSS) code in the admin panel. In order to perform a XSS attack, the file itself has to be open in a new card or loaded outside of the IMG tag. The problem applies both to the files opened on the admin panel and shop pages. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. As a workaround, require a library that adds on-upload file sanitization and overwrite the service before writing the file to the filesystem. The GitHub Security Advisory contains more specific information about the workaround.
- Product
- Sylius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2022Sylius is an open source eCommerce platform.CVE-2022-24743 · Other software · Sylius · reported by GitHubHigh 7.1
Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and unauthorized password change. The issue is fixed in versions 1.10.11 and 1.11.2. As a workaround, overwrite the `Sylius\Bundle\ApiBundle\CommandHandler\ResetPasswordHandler` class with code provided by the maintainers and register it in a container. More information about this workaround is available in the GitHub Security Advisory.
- Product
- Sylius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2022Sylius is an open source eCommerce platform.CVE-2022-24742 · Other software · Sylius · reported by GitHubMedium 5
Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. The application must strictly redirect to login page even browser back button is pressed. Another possibility is to set more strict cache policies for restricted content.
- Product
- Sylius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2022Sylius is an open source eCommerce platform.CVE-2022-24733 · Other software · Sylius · reported by GitHubMedium 6.1
Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface with a different interface provided by the attacker. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. Every response from app should have an X-Frame-Options header set to: ``sameorigin``. To achieve that, add a new `subscriber` in the app.
- Product
- Sylius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.