Show filters
49 Total Results
Displaying 11-20 of 49
Sort by:
Attacker Value
Unknown
CVE-2023-38330
Disclosure Date: August 02, 2023 (last updated February 25, 2025)
OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administration area. An attacker can upload a file with a modified header to create a HTTP Response Splitting attack.
0
Attacker Value
Unknown
CVE-2023-26260
Disclosure Date: April 11, 2023 (last updated February 24, 2025)
OXID eShop 6.2.x before 6.4.4 and 6.5.x before 6.5.2 allows session hijacking, leading to partial access of a customer's account by an attacker, due to an improper check of the user agent.
0
Attacker Value
Unknown
CVE-2013-10008
Disclosure Date: January 06, 2023 (last updated February 24, 2025)
A vulnerability was found in sheilazpy eShop. It has been classified as critical. Affected is an unknown function. The manipulation leads to sql injection. The name of the patch is e096c5849c4dc09e1074104531014a62a5413884. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217572.
0
Attacker Value
Unknown
CVE-2022-35493
Disclosure Date: August 08, 2022 (last updated February 24, 2025)
A Cross-site scripting (XSS) vulnerability in json search parse and the json response in wrteam.in, eShop - Multipurpose Ecommerce Store Website version 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the get_products?search parameter.
0
Attacker Value
Unknown
CVE-2020-35309
Disclosure Date: January 26, 2021 (last updated February 22, 2025)
Bakeshop Online Ordering System in PHP/MySQLi 1.0 is affected by cross-site scripting (XSS) which allows remote attackers to inject an arbitrary web script or HTML in admin dashboard - "Categories".
0
Attacker Value
Unknown
CVE-2019-17062
Disclosure Date: November 05, 2019 (last updated November 27, 2024)
An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop Enterprise Edition Version 5.2.x-5.3.x, OXID eShop Professional Edition Version 4.9.x-4.10.x and OXID eShop Community Edition Version: 4.9.x-4.10.x. By using a specially crafted URL, users with administrative rights could unintentionally grant unauthorized users access to the admin panel via session fixation.
0
Attacker Value
Unknown
CVE-2015-9413
Disclosure Date: September 26, 2019 (last updated November 27, 2024)
The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter.
0
Attacker Value
Unknown
CVE-2019-13026
Disclosure Date: July 30, 2019 (last updated November 27, 2024)
OXID eShop 6.0.x before 6.0.5 and 6.1.x before 6.1.4 allows SQL Injection via a crafted URL, leading to full access by an attacker. This includes all shopping cart options, customer data, and the database. No interaction between the attacker and the victim is necessary.
0
Attacker Value
Unknown
CVE-2018-20715
Disclosure Date: January 15, 2019 (last updated November 08, 2023)
The DB abstraction layer of OXID eSales 4.10.6 is vulnerable to SQL injection via the oxid or synchoxid parameter to the oxConfig::getRequestParameter() method in core/oxconfig.php.
0
Attacker Value
Unknown
CVE-2018-18804
Disclosure Date: November 16, 2018 (last updated November 27, 2024)
Bakeshop Inventory System 1.0 has SQL injection via the login screen, related to include/publicfunction.vb.
0
