Skalvin

Existe um problema no arquivo `/products/superstorefinder/index.php` onde a manipulação do argumento `lat/lng` permite a injeção de SQL, uma técnica usada para interferir nas consultas que um aplicativo faz ao seu banco de dados. Isso permite a exploração remota do sistema.

Uma injeção de SQL remota existe devido ao processamento inadequado do arquivo `/stores/all-products`. Um invasor pode explorar isso manipulando o argumento `rating`, permitindo consultas não autorizadas ao banco de dados.

Existe uma falha no processamento do arquivo `/search` no abhicodebox ModernShop. A manipulação do argumento `q` pode levar a cross-site scripting, permitindo potencialmente ataques remotos. O exploit para esta falha foi publicado.

Existe uma falha de segurança no Wisencode até a versão 20251012. Este problema afeta uma funcionalidade desconhecida dentro do componente Create Support Ticket Handler, especificamente o arquivo `/support-ticket/create`. A manipulação do argumento `Message` pode resultar em cross-site scripting. O ataque pode ser iniciado remotamente. O fornecedor foi contatado sobre este problema, mas não respondeu.

Foi identificada uma vulnerabilidade no software, afetando uma função desconhecida do arquivo /extensions/realestate/index.php/properties/list/list-with-sidebar/realties. A manipulação do argumento `Itemid/jp yearbuilt` resulta em cross-site scripting. Esta vulnerabilidade pode ser explorada remotamente.

Uma falha crítica foi identificada no processamento do arquivo /extensions/realestate/index.php/properties/list/list-with-sidebar/realties do componente GET Parameter Handler. A manipulação do argumento `title` resulta em injeção de SQL. Esta falha pode ser explorada remotamente.

Foi identificada uma vulnerabilidade no EnvaySoft FleetCart que permite a divulgação de informações por meio da manipulação do argumento `razorpayKeyId`. O ataque pode ser executado remotamente, afetando uma funcionalidade ainda não identificada. Recomenda-se atualizar o componente afetado para proteger os dados.

Foi detectada uma falha no osCommerce que afeta uma função desconhecida do arquivo /catalog/all-products. A manipulação do argumento `cat` leva a um ataque de cross-site scripting. É possível lançar o ataque remotamente. A vulnerabilidade já foi divulgada ao público e pode estar sendo explorada.

A critical issue has been found in osCommerce 4, affecting some unknown functionality of the file /b2b-supermarket/shopping-cart of the component POST Parameter Handler. The manipulation of the argument `estimate[country id]` leads to sql injection. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

A problematic issue was found in osCommerce, affecting some unknown functionality of the file /catalog/compare of the component Instant Message Handler. The manipulation of the `compare` argument with a malicious input leads to cross-site scripting. The attack can be launched remotely.

A critical issue has been found in QDocs Smart School. This issue affects the /course/filterRecords/ file of the HTTP POST Request Handler component. The manipulation of the `searchdata[0][title]`, `searchdata[0][searchfield]`, and `searchdata[0][searchvalue]` arguments leads to SQL injection. It is possible to initiate the attack remotely. The vendor was contacted about this disclosure but did not respond.

A critical issue has been found in the GET Parameter Handler component, specifically affecting the /home/get tasks list file. The manipulation of the `project/status/user id/sort/search` argument leads to SQL injection.

A vulnerability was found in the GET Parameter Handler component of Academy LMS, affecting an unknown functionality of the file /academy/tutor/filter. The manipulation of the arguments `searched word`, `searched tution class type[]`, `searched price type[]`, and `searched duration[]` leads to cross-site scripting. The attack can be launched remotely.

A critical issue affects some unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the arguments `price min` and `price max` leads to SQL injection. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond.

A vulnerability was found in Infosoftbd Clcknshop, affecting unknown code of the file /collection/all. The manipulation of the argument `q` leads to cross site scripting. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in the component Redirect Handler, which affects some unknown processing and leads to information disclosure. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

A critical issue affects the processing of the file /collection/all of the component GET Parameter Handler. The manipulation of the `tag` argument leads to sql injection. The attack may be initiated remotely. The vendor was contacted about this disclosure but did not respond.

A vulnerability was found in the SPA-Cart eCommerce CMS, affecting some unknown functionality of the file /search. The manipulation of the arguments `filter[brandid]` and `filter[price]` leads to cross-site scripting. The attack may be launched remotely.

A critical vulnerability has been found in the GET Parameter Handler component of the /search file. The manipulation of the `filter[brandid]` argument leads to SQL injection. This issue can be initiated remotely.

A critical vulnerability was found in the component POST Request Handler, specifically in the file /portal/reports/account statement. The manipulation of the `date1` and `date2` arguments leads to SQL injection. The attack can be launched remotely.