Skalvin

توجد مشكلة في الملف `/products/superstorefinder/index.php` حيث تؤدي معالجة الوسيط `lat/lng` إلى حقن SQL، وهي تقنية تُستخدم للتدخل في الاستعلامات التي يجريها التطبيق على قاعدة بياناته. وهذا يسمح باستغلال النظام عن بُعد.

A remote SQL injection exists due to improper processing of the `/stores/all-products` file. An attacker can exploit this by manipulating the `rating` argument, allowing for unauthorized database queries.

يوجد خلل في معالجة الملف `/search` في abhicodebox ModernShop. قد يؤدي التلاعب بالمعلمة `q` إلى حدوث هجمات البرمجة النصية عبر المواقع (cross-site scripting)، مما يتيح إمكانية شن هجمات عن بُعد. وقد تم نشر استغلال لهذا الخلل.

يوجد ثغرة أمنية في Wisencode حتى الإصدار 20251012. تؤثر هذه المشكلة على وظيفة غير معروفة داخل مكون Create Support Ticket Handler، وتحديدًا الملف `/support-ticket/create`. قد يؤدي التلاعب بالمعلمة `Message` إلى حدوث هجوم برمجة عبر المواقع (cross-site scripting). يمكن شن الهجوم عن بُعد. تم الاتصال بالمورد بشأن هذه المشكلة، لكنه لم يرد.

تم اكتشاف ثغرة أمنية في البرنامج تؤثر على وظيفة غير معروفة في الملف /extensions/realestate/index.php/properties/list/list-with-sidebar/realties. يؤدي التلاعب بالمعلمة `Itemid/jp yearbuilt` إلى حدوث هجوم عبر المواقع (cross-site scripting). يمكن استغلال هذه الثغرة عن بُعد.

تم تحديد ثغرة خطيرة في معالجة ملف /extensions/realestate/index.php/properties/list/list-with-sidebar/realties التابع لمكون GET Parameter Handler. يؤدي التلاعب بالمعلمة `title` إلى حدوث حقن SQL. يمكن استغلال هذه الثغرة عن بُعد.

A vulnerability has been found in EnvaySoft FleetCart, allowing for information disclosure through the manipulation of the `razorpayKeyId` argument. The attack can be launched remotely, affecting an unknown functionality. It is recommended to upgrade the affected component to secure data.

A problematic issue was found in osCommerce, affecting an unknown function of the file /catalog/all-products. The manipulation of the `cat` argument leads to cross-site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

A critical issue has been found in osCommerce 4, affecting some unknown functionality of the file /b2b-supermarket/shopping-cart of the component POST Parameter Handler. The manipulation of the argument `estimate[country id]` leads to sql injection. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

A problematic issue was found in osCommerce, affecting some unknown functionality of the file /catalog/compare of the component Instant Message Handler. The manipulation of the `compare` argument with a malicious input leads to cross-site scripting. The attack can be launched remotely.

A critical issue has been found in QDocs Smart School. This issue affects the /course/filterRecords/ file of the HTTP POST Request Handler component. The manipulation of the `searchdata[0][title]`, `searchdata[0][searchfield]`, and `searchdata[0][searchvalue]` arguments leads to SQL injection. It is possible to initiate the attack remotely. The vendor was contacted about this disclosure but did not respond.

A critical issue has been found in the GET Parameter Handler component, specifically affecting the /home/get tasks list file. The manipulation of the `project/status/user id/sort/search` argument leads to SQL injection.

A vulnerability was found in the GET Parameter Handler component of Academy LMS, affecting an unknown functionality of the file /academy/tutor/filter. The manipulation of the arguments `searched word`, `searched tution class type[]`, `searched price type[]`, and `searched duration[]` leads to cross-site scripting. The attack can be launched remotely.

A critical issue affects some unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the arguments `price min` and `price max` leads to SQL injection. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond.

A vulnerability was found in Infosoftbd Clcknshop, affecting unknown code of the file /collection/all. The manipulation of the argument `q` leads to cross site scripting. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in the component Redirect Handler, which affects some unknown processing and leads to information disclosure. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

A critical issue affects the processing of the file /collection/all of the component GET Parameter Handler. The manipulation of the `tag` argument leads to sql injection. The attack may be initiated remotely. The vendor was contacted about this disclosure but did not respond.

A vulnerability was found in the SPA-Cart eCommerce CMS, affecting some unknown functionality of the file /search. The manipulation of the arguments `filter[brandid]` and `filter[price]` leads to cross-site scripting. The attack may be launched remotely.

A critical vulnerability has been found in the GET Parameter Handler component of the /search file. The manipulation of the `filter[brandid]` argument leads to SQL injection. This issue can be initiated remotely.

A critical vulnerability was found in the component POST Request Handler, specifically in the file /portal/reports/account statement. The manipulation of the `date1` and `date2` arguments leads to SQL injection. The attack can be launched remotely.