Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,047 results · page 20 of 41
Mar 27, 2023SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategoryclass and xippostsclassCVE-2023-27847 · Other software · Xipblog Project · reported by MITRECritical 9.8
SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategoryclass and xippostsclass components.
- Product
- Xipblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iogithub.com
Mar 24, 2023SQL injection vulnerability found in PrestaShop smplredirectionsmanager v.1.1.19 and before allow a remote attacker to gain privileges via the SmplTools::getMatCVE-2023-26864 · Other software · Smplredirectionsmanager Project · reported by MITRECritical 9.8
SQL injection vulnerability found in PrestaShop smplredirectionsmanager v.1.1.19 and before allow a remote attacker to gain privileges via the SmplTools::getMatchingRedirectionsFromPartscomponent.
- Product
- Smplredirectionsmanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
Mar 23, 2023PrestaShop jmsblog 2.5.5 was discovered to contain a SQL injection vulnerability.CVE-2023-27034 · Other software · Joommasters · reported by MITRECritical 9.8
PrestaShop jmsblog 2.5.5 was discovered to contain a SQL injection vulnerability.
- Product
- JMS Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
Mar 22, 2023An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop.CVE-2023-27638 · Other software · Tshirtecommerce · reported by MITRECritical 9.8
An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised tshirtecommerce_design_cart_id GET parameter in order to exploit an insecure parameter in the functions hookActionCartSave and updateCustomizationTable, which could lead to a SQL injection. This is exploited in the wild in March 2023.
- Product
- Custom Product Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netfriends-of-presta.github.io
Mar 22, 2023An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop.CVE-2023-27637 · Other software · Tshirtecommerce · reported by MITRECritical 9.8
An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised product_id GET parameter in order to exploit an insecure parameter in the front controller file designer.php, which could lead to a SQL injection. This is exploited in the wild in March 2023.
- Product
- Custom Product Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netfriends-of-presta.github.io
Mar 22, 2023A vulnerability classified as critical has been found in Simple and Beautiful Shopping Cart System 1.0.CVE-2023-1558 · Other software · Simple And Beautiful Shopping Cart System Project · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Simple and Beautiful Shopping Cart System 1.0. This affects an unknown part of the file uploadera.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223551.
- Product
- Simple And Beautiful Shopping Cart System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2023The eo_tags package before 1.4.19 for PrestaShop allows SQL injection via a crafted _ga cookie.CVE-2023-27570 · Websites & servers · Prestashop · reported by MITRECritical 9.8
The eo_tags package before 1.4.19 for PrestaShop allows SQL injection via a crafted _ga cookie.
- Product
- EO Tags
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprofileo.comsecurity.profileo.com
Mar 21, 2023The eo_tags package before 1.3.0 for PrestaShop allows SQL injection via an HTTP User-Agent or Referer header.CVE-2023-27569 · Websites & servers · Prestashop · reported by MITRECritical 9.8
The eo_tags package before 1.3.0 for PrestaShop allows SQL injection via an HTTP User-Agent or Referer header.
- Product
- EO Tags
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprofileo.comsecurity.profileo.com
Mar 16, 2023WP Simple Shopping Cart: Sensitive Information ExposureCVE-2023-1431 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.6.3 due to the plugin saving shopping cart data exports in a publicly accessible location (/wp-content/plugins/wordpress-simple-paypal-shopping-cart/includes/admin/). This makes it possible for unauthenticated attackers to view information that should be limited to administrators only and can include data like first name, last name, email, address, IP Address, and more.
- Product
- WP Simple Shopping Cart
- Affected
- up to 4.6.3
- What to do
- Affects up to 4.6.3. Update WP Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 14, 2023PrestaShop ws_productreviews < 3.6.2 is vulnerable to SQL Injection.CVE-2023-25206 · Websites & servers · Prestashop · reported by MITREHigh 8.8
PrestaShop ws_productreviews < 3.6.2 is vulnerable to SQL Injection.
- Product
- Advanced Reviews
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comfriends-of-presta.github.io
Mar 13, 2023PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php.CVE-2023-25207 · Websites & servers · reported by MITRECritical 9.8
PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comfriends-of-presta.github.io
Mar 13, 2023PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF).CVE-2023-25170 · Websites & servers · PrestaShop · reported by GitHubMedium 5
PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). When authenticating users, PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enable same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. The problem is fixed in version 8.0.1.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023A vulnerability, which was classified as critical, has been found in SUL1SS_shop.CVE-2023-1276 · Other software · Sul1ss Shop Project · reported by VulDBMedium 4.7
A vulnerability, which was classified as critical, has been found in SUL1SS_shop. This issue affects some unknown processing of the file application\merch\controller\Order.php. The manipulation of the argument keyword leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-222599.
- Product
- Sul1ss Shop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtib36.github.iovuldb.com
Mar 6, 2023In the module "Xen Forum" (xenforum) for PrestaShop, an authenticated user can perform SQL injection in versions up to 2.13.0.CVE-2023-24763 · Websites & servers · Prestashop · reported by MITREHigh 8.8
In the module "Xen Forum" (xenforum) for PrestaShop, an authenticated user can perform SQL injection in versions up to 2.13.0.
- Product
- XEN Forum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comfriends-of-presta.github.io
Mar 6, 2023A vulnerability, which was classified as problematic, was found in ECshop up to 4.1.8.CVE-2023-1185 · Other software · Shopex · reported by VulDBMedium 4.7
A vulnerability, which was classified as problematic, was found in ECshop up to 4.1.8. This affects an unknown part of the component New Product Handler. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222357 was assigned to this vulnerability.
- Product
- Ecshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023A vulnerability, which was classified as problematic, has been found in ECshop up to 4.1.8.CVE-2023-1184 · Other software · Shopex · reported by VulDBMedium 4.7
A vulnerability, which was classified as problematic, has been found in ECshop up to 4.1.8. Affected by this issue is some unknown functionality of the file admin/database.php of the component Backup Database Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222356.
- Product
- Ecshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2023Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences.CVE-2023-26052 · Other software · saleor · reported by GitHubLow 3.7
Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated requests. This issue has been patched in versions 3.1.48, 3.7.59, 3.8.0, 3.9.27, 3.10.14 and 3.11.12.
- Product
- saleor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2023Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences.CVE-2023-26051 · Other software · saleor · reported by GitHubMedium 6.5
Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like user email address in staff-authenticated requests.
- Product
- saleor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023The PrestaShop e-commerce platform module stripejs contains a Blind SQL injection vulnerability up to version 4.5.5.CVE-2023-23315 · Other software · Stripe · reported by MITRECritical 9.8
The PrestaShop e-commerce platform module stripejs contains a Blind SQL injection vulnerability up to version 4.5.5. The method `stripejsValidationModuleFrontController::initContent()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
- Product
- Stripe Payment Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in HasThemes ShopLentor plugin <= 2.5.1 leading to plugin settings change.CVE-2022-46798 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in HasThemes ShopLentor plugin <= 2.5.1 leading to plugin settings change.
- Fixed in
- 2.5.2
- What to do
- Update the plugin to 2.5.2 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 21, 2023ShopLentor: Unserializes user input from cookies in order to track viewed products and user dataCVE-2023-0232 · WordPress plugins & themes · reported by WPScanCritical 9.8
The ShopLentor WordPress plugin before 2.5.4 unserializes user input from cookies in order to track viewed products and user data, which could lead to PHP Object Injection.
- Product
- ShopLentor
- Fixed in
- 2.5.4
- What to do
- Update ShopLentor to 2.5.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2023ShopLentor: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0231 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ShopLentor WordPress plugin before 2.5.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- ShopLentor
- Fixed in
- 2.5.4
- What to do
- Update ShopLentor to 2.5.4 or newer.
Feb 17, 2023Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memoryCVE-2023-21578 · Other software · Adobe · reported by AdobeMedium 5.5
Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Feb 17, 2023Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memoryCVE-2023-21577 · Other software · Adobe · reported by AdobeMedium 5.5
Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Feb 17, 2023Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution inCVE-2023-21576 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Feb 17, 2023Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution inCVE-2023-21575 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Feb 17, 2023Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code executCVE-2023-21574 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Feb 14, 2023Cross-Site Request Forgery (CSRF) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart plugin <= 6.11.3 versions.CVE-2023-24377 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart plugin <= 6.11.3 versions.
- Affected
- up to 6.11.3
- What to do
- Affects up to 6.11.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 11, 2023A vulnerability was found in EcShop 4.1.5.CVE-2023-0783 · Other software · Shopex · reported by VulDBMedium 4.7
A vulnerability was found in EcShop 4.1.5. It has been classified as critical. This affects an unknown part of the file /ecshop/admin/template.php of the component PHP File Handler. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220641 was assigned to this vulnerability.
- Product
- Ecshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023SwagPayPal is a PayPal integration for shopware/platform.CVE-2023-23941 · Other software · shopware · reported by GitHubHigh 7.5
SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card), the amount and item list sent to PayPal may not be identical to the one in the created order. The problem has been fixed with version 5.4.4. As a workaround, disable the aforementioned payment methods or use the Security Plugin in version >= 1.0.21.
- Product
- SwagPayPal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023PrestaShop module, totadministrativemandate before v1.7.1 was discovered to contain a SQL injection vulnerability.CVE-2022-46965 · Websites & servers · reported by MITREHigh 8.1
PrestaShop module, totadministrativemandate before v1.7.1 was discovered to contain a SQL injection vulnerability.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2023A vulnerability in the descarga_etiqueta.php component of Correos Prestashop 1.7.x allows attackers to execute a directory traversal.CVE-2022-46639 · Other software · Correos · reported by MITREHigh 7.5
A vulnerability in the descarga_etiqueta.php component of Correos Prestashop 1.7.x allows attackers to execute a directory traversal.
- Product
- Correos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordia-informatica.comia-informatica.com
Jan 23, 2023WordPress Simple Shopping Cart: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4672 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Simple Shopping Cart WordPress plugin before 4.6.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- WordPress Simple Shopping Cart
- Fixed in
- 4.6.2
- What to do
- Update WordPress Simple Shopping Cart to 4.6.2 or newer.
Jan 17, 2023Shopware is an open source commerce platform based on Symfony Framework and Vue js.CVE-2023-22734 · Other software · shopware · reported by GitHubMedium 4.3
Shopware is an open source commerce platform based on Symfony Framework and Vue js. The newsletter double opt-in validation was not checked properly, and it was possible to skip the complete double opt in process. As a result operators may have inconsistencies in their newsletter systems. This problem has been fixed with version 6.4.18.1. Users are advised to upgrade. Users unable to upgrade may find security measures are available via a plugin for major versions 6.1, 6.2, and 6.3. Users may also disable newsletter registration completely.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Jan 17, 2023Shopware is an open source commerce platform based on Symfony Framework and Vue js.CVE-2023-22733 · Other software · shopware · reported by GitHubLow 2.7
Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions the log module would write out all kind of sent mails. An attacker with access to either the local system logs or a centralized logging store may have access to other users accounts. This issue has been addressed in version 6.4.18.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. Users unable to upgrade may remove from all users the log module ACL rights or disable logging.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.shopware.comdocs.shopware.com
Jan 17, 2023Shopware is an open source commerce platform based on Symfony Framework and Vue js.CVE-2023-22732 · Other software · shopware · reported by GitHubLow 3.7
Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one week, when an attacker has stolen the session cookie they could use it for a long period of time. In version 6.4.18.1 an automatic logout into the Administration session has been added. As a result the user will be logged out when they are inactive. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Jan 17, 2023Shopware is an open source commerce platform based on Symfony Framework and Vue js.CVE-2023-22731 · Other software · shopware · reported by GitHubCritical 9.9
Shopware is an open source commerce platform based on Symfony Framework and Vue js. In a Twig environment **without the Sandbox extension**, it is possible to refer to PHP functions in twig filters like `map`, `filter`, `sort`. This allows a template to call any global PHP function and thus execute arbitrary code. The attacker must have access to a Twig environment in order to exploit this vulnerability. This problem has been fixed with 6.4.18.1 with an override of the specified filters until the integration of the Sandbox extension has been finished. Users are advised to upgrade. Users of major versions 6.1, 6.2, and 6.3 may also receive this fix via a plugin.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Jan 17, 2023Shopware is an open source commerce platform based on Symfony Framework and Vue js.CVE-2023-22730 · Other software · shopware · reported by GitHubMedium 5.3
Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions It was possible to put the same line item multiple times in the cart using the AP. The Cart Validators checked the line item's individuality and the user was able to bypass quantity limits in sales. This problem has been fixed with version 6.4.18.1. Users on major versions 6.1, 6.2, and 6.3 may also obtain this fix via a plugin.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Jan 6, 2023A vulnerability was found in sheilazpy eShop.CVE-2013-10008 · Other software · sheilazpy · reported by VulDBMedium 5.5
A vulnerability was found in sheilazpy eShop. It has been classified as critical. Affected is an unknown function. The manipulation leads to sql injection. The name of the patch is e096c5849c4dc09e1074104531014a62a5413884. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217572.
- Product
- eShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2022A vulnerability was found in Shoplazza LifeStyle 1.1.CVE-2022-4602 · Other software · Shoplazza · reported by VulDBLow 3.5
A vulnerability was found in Shoplazza LifeStyle 1.1. It has been rated as problematic. This issue affects some unknown processing of the file /admin/api/theme-edit/ of the component Review Flow Handler. The manipulation of the argument Title leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-216197 was assigned to this vulnerability.
- Product
- LifeStyle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Dec 18, 2022A vulnerability was found in Shoplazza LifeStyle 1.1.CVE-2022-4601 · Other software · Shoplazza · reported by VulDBLow 3.5
A vulnerability was found in Shoplazza LifeStyle 1.1. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/api/theme-edit/ of the component Shipping/Member Discount/Icon. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-216196.
- Product
- LifeStyle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Dec 18, 2022A vulnerability was found in Shoplazza LifeStyle 1.1.CVE-2022-4600 · Other software · Shoplazza · reported by VulDBLow 3.5
A vulnerability was found in Shoplazza LifeStyle 1.1. It has been classified as problematic. This affects an unknown part of the file /admin/api/theme-edit/ of the component Product Carousel Handler. The manipulation of the argument Heading/Description leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-216195.
- Product
- LifeStyle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Dec 18, 2022A vulnerability was found in Shoplazza LifeStyle 1.1 and classified as problematic.CVE-2022-4599 · Other software · Shoplazza · reported by VulDBLow 3.5
A vulnerability was found in Shoplazza LifeStyle 1.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/api/theme-edit/ of the component Product Handler. The manipulation of the argument Subheading/Heading/Text/Button Text/Label leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-216194 is the identifier assigned to this vulnerability.
- Product
- LifeStyle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Dec 18, 2022A vulnerability has been found in Shoplazza LifeStyle 1.1 and classified as problematic.CVE-2022-4598 · Other software · Shoplazza · reported by VulDBLow 3.5
A vulnerability has been found in Shoplazza LifeStyle 1.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/api/theme-edit/ of the component Announcement Handler. The manipulation of the argument Text/Mobile Text leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-216193 was assigned to this vulnerability.
- Product
- LifeStyle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Dec 18, 2022A vulnerability, which was classified as problematic, was found in Shoplazza LifeStyle 1.1.CVE-2022-4597 · Other software · Shoplazza · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Shoplazza LifeStyle 1.1. Affected is an unknown function of the file /admin/api/admin/v2_products of the component Create Product Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-216192.
- Product
- LifeStyle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Dec 18, 2022A vulnerability, which was classified as problematic, has been found in Shoplazza 1.1.CVE-2022-4596 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Shoplazza 1.1. This issue affects some unknown processing of the file /admin/api/admin/articles/ of the component Add Blog Post Handler. The manipulation of the argument Title leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-216191.
- Product
- Shoplazza
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Dec 9, 2022Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /services/view_service.php.CVE-2022-44838 · Other software · Automotive Shop Management System Project · reported by MITREHigh 7.2
Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /services/view_service.php.
- Product
- Automotive Shop Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2022PrestaShop is an open-source e-commerce solution.CVE-2022-46158 · Websites & servers · PrestaShop · reported by GitHubMedium 5.3
PrestaShop is an open-source e-commerce solution. Versions prior to 1.7.8.8 did not properly restrict host filesystem access for users. Users may have been able to view the contents of the upload directory without appropriate permissions. This issue has been addressed and users are advised to upgrade to version 1.7.8.8. There are no known workarounds for this issue.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2022A cross-site scripting (XSS) vulnerability in ClicShopping_V3 v3.402 allows attackers to execute arbitrary web scripts or HTML via a crafted URL parameter.CVE-2022-45769 · Other software · Clicshopping · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in ClicShopping_V3 v3.402 allows attackers to execute arbitrary web scripts or HTML via a crafted URL parameter.
- Product
- Clicshopping V3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2022Online-shopping-system-advanced 1.0 was discovered to contain a SQL injection vulnerability via the p parameter at /shopping/product.php.CVE-2022-42109 · Other software · Online-shopping-system-advanced Project · reported by MITRECritical 9.8
Online-shopping-system-advanced 1.0 was discovered to contain a SQL injection vulnerability via the p parameter at /shopping/product.php.
- Product
- Online-shopping-system-advanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.