Ecommerce Template vulnerabilities
3 known vulnerabilities in Ecommerce Template from MarcosCamara01. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.1 High severity
Ecommerce Template: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and modify the cart and wishlist rows of any other user, because cartRepository.delete
- 7.1 High severity
Ecommerce Template: External Control of Assumed-Immutable Web Parameter
External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another,
- 8.2 High severity
Ecommerce Template: Missing Authentication for Critical Functionality
Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts), exposed at GET /api/stripe/checkout_sessions, in MarcosCamara01 Ecommerce Template before commit 91e273c allows a rem