Vulnerabilidades de Detronetdip
CVEs publicadas que afetam produtos de Detronetdip: 4 registro(s), com severidade, exploração e correções.
CVE-2025-15583
Média · 5.4
CWE-79 20/02/2026
detronetdip E-commerce function.php get_safe_value cross site scripting
A weakness has been identified in detronetdip E-commerce 1.0.0. This affects the function get_safe_value of the file utility/function.php. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2025-15582
Alta · 8.1
CWE-639 20/02/2026
detronetdip E-commerce Product Management Update authorization
A security flaw has been discovered in detronetdip E-commerce 1.0.0. The impacted element is the function Delete/Update of the component Product Management Module. Performing a manipulation of the argument ID results in authorization bypass. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-2165
Crítica · 9.8
CWE-306 08/02/2026
Detronetdip E-commerce 1.0.0: falta de autenticação na criação de contas (CVE-2026-2165)
Foi identificada uma fraqueza no detronetdip E-commerce 1.0.0. É afetada uma função desconhecida do arquivo /Admin/assets/backend/seller/add_seller.php do componente Account Creation Endpoint. A manipulação do argumento email pode levar à falta de autenticação. O ataque pode ser executado remotamente. O exploit foi disponibilizado ao público e pode ser usado em ataques. O projeto foi informado do problema cedo por meio de um relato de issue, mas ainda não respondeu.
CVE-2026-2164
Crítica · 9.8
CWE-434 08/02/2026
detronetdip E-commerce addadhar.php unrestricted upload
A security flaw has been discovered in detronetdip E-commerce 1.0.0. This issue affects some unknown processing of the file /seller/assets/backend/profile/addadhar.php. Performing a manipulation of the argument File results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.