Sunshine Photo Cart
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:sunshine_photo_cart:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Sunshine Photo Cart (41341837-60b2-532a-b907-950666645e5f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-85037 |
vulnerable | 2026-09-16 04:33:08.224128 |
Sunshine Photo Cart < 3.7 - Unauthenticated Price Manipulation via IDOR
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that price, resulting in financial loss for the site owner.
Published: 2026-09-09T06:00:08.416Z
Updated: 2026-09-09T15:29:38.794Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16561 |
vulnerable | 2026-09-16 04:32:56.397270 |
Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries.
Published: 2026-08-05T06:00:08.874Z
Updated: 2026-08-05T14:51:36.628Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4301 |
vulnerable | 2026-06-08 05:51:37.158149 |
Sunshine Photo Cart < 2.9.15 - Reflected XSS
The Sunshine Photo Cart WordPress plugin before 2.9.15 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
Published: 2023-01-09T22:13:37.475Z
Updated: 2025-04-09T19:19:48.209Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.