Vulnerability history

SQL Injection vulnerability

Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action vulnerability

Authenticated (Administrator+) SQL Injection via 'product_order' Parameter vulnerability

SQL Injection vulnerability

SQL Injection vulnerability

Sensitive Data Exposure vulnerability

Missing Authorization to Order Updates vulnerability

Authenticated (Contributor+) SQL Injection via model_number Parameter vulnerability

Broken Access Control vulnerability

Sensitive Information Exposure vulnerability

Authenticated (Contributor+) SQL Injection vulnerability

Cross Site Request Forgery (CSRF) vulnerability

Authenticated (Administrator+) SQL Injection via 'orderby' vulnerability

Cross-Site Request Forgery via process_delete_product vulnerability

Cross-Site Request Forgery via process_bulk_delete_product vulnerability

Cross-Site Request Forgery via process_bulk_deactivate_product vulnerability

Cross-Site Request Forgery via process_deactivate_product vulnerability

Cross-Site Request Forgery via process_duplicate_product vulnerability

Cross-Site Request Forgery via process_bulk_activate_product vulnerability

Admin+ LFI vulnerability

Arbitrary Design Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)

Privilege Escalation

Unrestricted File Upload

Information Disclosure