CVE Vulnerability Catalog

The Barcode Scanner with Inventory & Order Manager plugin in versions up to and including 1.13.1 contains a Cross Site Scripting (XSS) flaw exploitable by an unauthenticated attacker. This allows injection of malicious script into site pages.

The KuteShop theme in versions up to and including 4.2.9 is vulnerable to unauthenticated Local File Inclusion. An attacker can load files from the server.

The KuteShop theme in versions up to and including 4.2.9 contains an unauthenticated Cross Site Scripting (XSS) flaw. It allows injection of malicious script into site pages.

The Boutique theme in versions up to and including 2.3.3 is vulnerable to unauthenticated Local File Inclusion. An attacker can load files from the server.

The Boutique plugin in versions up to 2.3.3 contains an unauthenticated content injection vulnerability. An unauthenticated attacker can inject arbitrary content.

The Biolife theme in versions up to and including 3.2.3 is vulnerable to unauthenticated Local File Inclusion. An attacker can load files from the server.

The Biolife theme in versions up to and including 3.2.3 contains an unauthenticated Cross Site Scripting (XSS) flaw. It allows injection of malicious script into site pages.

Unauthenticated Local File Inclusion (LFI) in TechOne versions up to 3.0.3. Allows an attacker to read files from the server without authentication.

Unauthenticated Cross Site Scripting (XSS) in TechOne versions up to 3.0.3. Allows an attacker to inject malicious scripts into a victim's browser.

Unauthenticated Local File Inclusion (LFI) in Armania versions up to 1.4.8. Allows an attacker to read files from the server without authentication.

Unauthenticated Cross Site Scripting (XSS) in Armania versions up to 1.4.8. Allows an attacker to inject malicious scripts into a victim's browser.

PHP Object Injection vulnerability in the WineShop theme in versions up to and including 3.20. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The vulnerability stems from a lack of input validation.

PHP Object Injection vulnerability in the Equadio theme in versions up to and including 1.1.4. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The vulnerability stems from a lack of input validation.

PHP Object Injection vulnerability in Juno versions up to and including 2.25. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The issue affects unauthenticated access.

Unauthenticated Cross Site Scripting (XSS) in Pin WP versions up to 7.0. Allows an attacker to inject malicious scripts into a victim's browser.

PHP Object Injection vulnerability in Avala versions up to and including 1.1.4. An unauthenticated attacker can inject a malicious PHP object. This may lead to further exploitation of the system.

PHP Object Injection vulnerability in Kalles versions up to and including 1.1.7.1. An unauthenticated attacker can inject a malicious PHP object. This may lead to further exploitation of the system.

Unauthenticated Local File Inclusion (LFI) in Backhoe versions up to 2.0. Allows an attacker to read files from the server without authentication.

Unauthenticated Local File Inclusion (LFI) in Ozeum versions up to 1.3.0. Allows an attacker to read files from the server without authentication.

Unauthenticated Local File Inclusion (LFI) in Flipmart versions up to 2.8. Allows an attacker to read files from the server without authentication.