Vendor
shopizer-ecommerce
6 known vulnerabilities.
Products
4 results · Clear filters · Feed
-
Medium 6.5
Shopizer - IDOR delete superadmin
In Shopizer versions 2.0 to 2.17.0 a regular admin can permanently delete a superadmin (although this cannot happen according to the documentation) via Insecure Direct Object Reference (IDOR) vulnerability.
-
Medium 4.8
Shopizer - Stored XSS in Manage Files
A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0, where a privileged user (attacker) can inject malicious JavaScript in the filename under the “Manage files” tab
-
Medium 4.8
Shopizer - Stored XSS in Manage Images
A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code.
-
Medium 6.5
Negative charge in shopping cart possible in Shopizer
In Shopizer before version 2.11.0, using API or Controller based versions negative quantity is not adequately validated hence creating incorrect shopping cart and order total. This vulnerability makes it possible to create a negative total in the shopping car…