#E-Commerce
All CosmicBytez Labs articles tagged #E-Commerce, across news, security advisories, how-to guides, and projects.
- News
BigCommerce Data Stolen via Ribon Apps Hack
A compromised BigCommerce application key held by third-party app Ribon exposed merchant customer data across affected storefronts.
- Security
CVE-2026-63472: Vendure External-Authentication Account Takeover
A CVSS 9.1 flaw lets attackers bind their external login to a victim's Vendure account by email match alone, enabling full account takeover.
- News
Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
StyleSmuggler, a Magento zero-day found by Sansec, injects PHP via failed-payment emails to drop a Rust backdoor on live stores.
- Security
CVE-2026-15490: SQL Injection in TOKO-ONLINE-ROTI Product Add Endpoint
A high-severity SQL injection vulnerability in the TOKO-ONLINE-ROTI PHP bakery system allows remote attackers to manipulate the kode_produk and kd_cs...
- Security
CVE-2026-5955: BiEticaret E-Commerce SQL Injection (CVSS 9.8)
A critical SQL injection vulnerability in Inrove Software's BiEticaret e-commerce platform (versions before v3.3.57) allows unauthenticated attackers to...
- Security
SQL Injection in Multi-Vendor Online Grocery Management System (CVE-2026-14695)
A high-severity SQL injection vulnerability in SourceCodester's Multi-Vendor Online Grocery Management System 1.0 allows remote attackers to manipulate...
- Security
SQL Injection in Pizzafy E-Commerce System Exposes Order Data (CVE-2026-14713)
A remotely exploitable SQL injection flaw in SourceCodester Pizzafy E-Commerce System 1.0 allows attackers to manipulate the confirm_order endpoint via an...
- Security
CVE-2026-12204: ShopXO Scheduled Task Authorization Bypass
A CVSS 7.3 authorization bypass vulnerability in ShopXO up to 6.7.1 allows unauthenticated access to scheduled task endpoints in the Crontab controller,...
- News
Coupang Hit with Record $409 Million Data Breach Fine in South Korea
South Korea's Personal Information Protection Commission has fined e-commerce giant Coupang a record 624.6 billion won — approximately $409 million —...
- Security
CVE-2026-45247 — Mirasvit Magento 2 Cache Warmer PHP Object Injection RCE
CVSS 9.8 PHP object injection in Mirasvit Full Page Cache Warmer for Magento 2 lets unauthenticated attackers achieve RCE — patch to 1.11.12 now.
- Security
CVE-2026-39079: PrestaShop UPS Shipping Module Sensitive
CVE-2026-39079 is a CVSS 7.5 (High) information disclosure vulnerability in the PrestaShop upsshipping module affecting all versions through 2.4.0. Remote...
- Security
Critical Blind SQL Injection in Akilli E-Commerce Website
A CVSS 9.8 blind SQL injection vulnerability in Akilli Commerce's e-commerce platform allows unauthenticated attackers to extract the entire database...
- Security
Critical Session Hijacking via Auth Bypass in Akilli
CVE-2026-2347 is a CVSS 9.8 authorization bypass in Akilli's e-commerce platform, allowing attackers to hijack authenticated sessions by manipulating...
- Security
CVE-2026-44212: PrestaShop Stored XSS in Customer Service
A stored Cross-Site Scripting vulnerability (CVSS 9.3) in PrestaShop's back-office Customer Service view allows unauthenticated attackers to inject...
- Security
CVE-2026-44377: CubeCart Authenticated SSTI via Smarty
An authenticated Server-Side Template Injection vulnerability in CubeCart prior to 6.7.0 allows attackers with API key access to execute arbitrary code...
- Security
CVE-2026-45053: CubeCart REST API Arbitrary PHP File Upload
A critical arbitrary file upload vulnerability in CubeCart's REST API File Manager allows holders of a files:rw API key to upload PHP webshells to the web...
- News
Škoda Warns of Customer Data Breach After Online Shop Hack
Škoda Auto, the Czech automaker wholly owned by Volkswagen Group, has disclosed a data breach after attackers compromised its official online shop and...
- News
Skoda Data Breach Hits Online Shop Customers
Hackers exploited a vulnerability in Skoda's online shop portal to access customer personal data including names, addresses, email addresses, and phone...
- News
Hackers Use Pixel-Large SVG Trick to Hide Credit Card
A massive campaign targeting nearly 100 Magento e-commerce stores embeds credit card-stealing JavaScript inside a pixel-sized SVG image, bypassing visual...
- News
PolyShell Attacks Target 56% of All Vulnerable Magento
Mass exploitation is underway against Magento 2 and Adobe Commerce installations using the 'PolyShell' polyglot file upload vulnerability, with attackers...
- News
WebRTC Skimmer Bypasses CSP to Steal Payment Data from E-Commerce Sites
Cybersecurity researchers have uncovered a sophisticated new payment skimmer that weaponises WebRTC data channels to exfiltrate stolen credit card data...