Vulnerability history

Unauthenticated Order PII Disclosure and Note Manipulation vulnerability

Vendor+ Reverse Withdrawal Ledger Credit Without Payment vulnerability

Unauthenticated Email Sender Spoofing vulnerability

Admin+ Cross-Site Vendor Activation vulnerability

Broken Access Control vulnerability

Broken Access Control vulnerability

PHP Object Injection vulnerability

Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover vulnerability

Vendor+ Cross-Vendor Commission Settings Disclosure vulnerability

Shop Manager+ Arbitrary Plugin Installation/Activation via REST API vulnerability

Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint vulnerability

Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint vulnerability

Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API vulnerability

Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount vulnerability

Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint vulnerability

Privilege Escalation vulnerability

Broken Access Control vulnerability

Cross Site Scripting (XSS) vulnerability

Authenticated (Custom+) Stored Cross-Site Scripting vulnerability

Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure vulnerability

Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Order Modification vulnerability

Privilege Escalation vulnerability

Unauthenticated Information Disclosure in Store Reviews REST API Endpoint vulnerability

Broken Authentication vulnerability

Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure vulnerability

Privilege Escalation vulnerability

PHP Object Injection vulnerability

Authenticated SQL Injection vulnerability

Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability