craftcms/commerce vulnerabilities (Packagist)
21 vulnerabilities.
-
craftcms/commercePackagist Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass 6.9 Medium -
craftcms/commercePackagist Craft Commerce: Partial Payment Amount Without Lower Bound Validation 6.9 Medium -
craftcms/commercePackagist Craft Commerce: Blind SQL Injection via hasVariant/hasProduct 8.7 High -
craftcms/commercePackagist Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget 7.7 High -
craftcms/commercePackagist Craft Commerce: Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonymous payments 1.7 Low -
craftcms/commercePackagist Craft Commerce has a Potential IDOR in Commerce carts 6.3 Medium -
craftcms/commercePackagist Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout 1.9 Low -
craftcms/commercePackagist Craft Commerce has Stored XSS in Inventory Location Name 4.8 Medium -
craftcms/commercePackagist Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking 8.6 High -
craftcms/commercePackagist Craft Commerce has a SQL Injection in Commerce Inventory Table Sorting 8.7 High -
craftcms/commercePackagist Craft Commerce has Stored XSS while updating Order Status from Orders Table 1.9 Low -
craftcms/commercePackagist Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting 8.7 High -
craftcms/commercePackagist Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation 6.1 Medium -
craftcms/commercePackagist Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation 6.1 Medium -
craftcms/commercePackagist Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation 6.1 Medium -
craftcms/commercePackagist Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation 6.1 Medium -
craftcms/commercePackagist Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation 6.1 Medium -
craftcms/commercePackagist Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation 6.1 Medium -
craftcms/commercePackagist Craft Commerce has Stored XSS in Product Type Name 4.8 Medium -
craftcms/commercePackagist Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration 6.2 Medium -
craftcms/commercePackagist Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget) 6.2 Medium