Approved changes feed: RSS · Atom
cpe:2.3:a:behance:smartshop:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Behance (bed93cdb-fb55-5731-bd33-62dfdb60d67e) |
|---|---|
| Product | Smartshop (f536b4b8-c37b-5733-96d4-d8db1abe9f45) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2018-25343 |
vulnerable | 2026-06-08 05:11:29.810660 |
Smartshop 1 Cross-Site Request Forgery via editprofile.php
MEDIUM (4.3)
Smartshop 1 contains a cross-site request forgery vulnerability that allows attackers to modify user profiles by tricking authenticated users into submitting malicious requests. Attackers can craft HTML forms targeting editprofile.php with hidden fields for email and password parameters that execute automatically when visited by an authenticated admin user.
Published: 2026-05-23T18:30:45.936Z
Updated: 2026-05-27T16:10:36.062Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-25342 |
vulnerable | 2026-06-08 05:11:29.810535 |
Smartshop 1 SQL Injection via search.php
HIGH (8.2)
Smartshop 1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'searched' parameter in search.php. Attackers can send GET requests with malicious SQL payloads like SLEEP commands to extract sensitive database information including product details and system data.
Published: 2026-05-23T18:30:45.008Z
Updated: 2026-05-26T18:23:21.353Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-25341 |
vulnerable | 2026-06-08 05:11:29.810390 |
Smartshop 1 SQL Injection via product.php id Parameter
HIGH (8.2)
Smartshop 1 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to product.php with union-based SQL injection payloads in the id parameter to extract sensitive database information including usernames and database names.
Published: 2026-05-23T18:30:44.302Z
Updated: 2026-05-26T18:40:32.609Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-25340 |
vulnerable | 2026-06-08 05:11:29.810170 |
Smartshop 1 SQL Injection via category.php
HIGH (8.2)
Smartshop 1 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to category.php with UNION-based SQL injection payloads in the id parameter to extract sensitive database information including usernames and other data.
Published: 2026-05-23T18:30:43.107Z
Updated: 2026-05-26T14:04:11.717Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.