a-shop vulnerabilities and exploits

(subscribe to this query)

Directory traversal vulnerability in admin/filebrowser.asp in A-shop 0.70 and previous versions, and possibly 0.71, allows remote malicious users to delete arbitrary files via unspecified filename references in the delfiles parameter.

1 EDB exploit

Multiple SQL injection vulnerabilities in A-shop 0.70 and previous versions allow remote malicious users to execute arbitrary SQL commands via unspecified vectors.

1 EDB exploit

File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote malicious users to run arbitrary code via the image upload feature when customizing a shop.

Cs-cart Cs-cart Multivendor Cs-cart Cs-cart Multivendor 4.16.1

SQL injection vulnerability in index.php in PHPShop 0.8.1 allows remote malicious users to execute arbitrary SQL commands via the product_id parameter, as demonstrated by a shop/flypage action.

Phpshop Phpshop 0.8.1

2 EDB exploits

Cross-site request forgery (CSRF) vulnerability in PhpShop 0.8.1 allows remote malicious users to hijack the authentication of arbitrary users for requests that invoke the cartAdd function in a shop/cart action to the default URI.

Phpshop Phpshop 0.8.1

The logging system of the Automattic WooCommerce plugin prior to 3.4.6 for WordPress is vulnerable to a File Deletion vulnerability. This allows deletion of woocommerce.php, which leads to certain privilege checks not being in place, and therefore a shop manager can escalate priv...

Woocommerce Woocommerce

Multiple SQL injection vulnerabilities in index.php in PhpShop 0.8.1 allow remote malicious users to execute arbitrary SQL commands via the (1) module_id parameter in an admin/function_list action, the (2) vendor_id parameter in a vendor/vendor_form action, the (3) module_id para...

Phpshop Phpshop 0.8.1

2 EDB exploits

The address-management feature in xt:Commerce 5.1 to 6.2.2 allows remote authenticated users to zero out other user's stored addresses by manipulating an id field in the POST request for altering an address.

Xt-commerce Xt-commerce

In Sylius prior to 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Not...

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook