Overview

Saleor is an open-source headless commerce platform that exposes store operations exclusively through a GraphQL API. Its architecture isolates transactional core logic from frontend presentation, enabling engineering teams to deploy tailored shopping experiences while retaining full custody of customer and order data.

Why Saleor instead of Shopify

Shopify maintains all customer accounts, order histories, and payment records on multi-tenant proprietary cloud infrastructure. Merchants operating on Shopify encounter strict limitations when customizing checkout workflows, face platform-level API rate limits, and must accept added transaction surcharges when routing payments through third-party gateways. For digital agencies and technical operators managing client data under stringent privacy regulations such as GDPR, relying on an opaque external cloud creates compliance challenges and architectural lock-in.

Saleor addresses these constraints by placing the commerce engine directly within your own cloud or on-premise infrastructure. Engineering teams retain unfettered access to the underlying PostgreSQL database, enabling custom data retention policies, localized data residency compliance, and custom payment gateway integrations without platform revenue shares. This architectural freedom demands dedicated operational responsibility: while Shopify manages server scaling, edge performance, and automated software patches, running Saleor requires teams to provision, secure, and maintain their own container clusters, database backups, and background workers.

What it does well

Multi-channel and multi-currency controls allow agencies to manage separate regional storefronts, price lists, and inventory allocations from a single deployment without duplicating databases.
The GraphQL API provides complete type safety and schema introspectability, letting frontend teams fetch precise product datasets for Next.js or mobile applications without over-fetching.
The decoupled administration dashboard provides a fast, modern React interface for merchandising teams while communicating with the core entirely through authenticated GraphQL queries.
An asynchronous webhook and application architecture replaces internal plugin dependencies with isolated web services, ensuring third-party extensions cannot crash the core commerce service during upgrades.

cat > .env <<EOF SECRET_KEY=$(openssl rand -hex 32) POSTGRES_PASSWORD=$(openssl rand -hex 12) ADMIN_PASSWORD=$(openssl rand -hex 12) PUBLIC_URL=http://localhost:8000/ API_URL=http://localhost:8000/graphql/ ALLOWED_CLIENT_HOSTS=localhost,127.0.0.1 ALLOWED_HOSTS=* EOF

services: init: image: ghcr.io/saleor/saleor:3.23.45 restart: "no" depends_on: db: condition: service_healthy cache: condition: service_healthy volumes: - saleor-media:/app/media - saleor-keys:/app/keys environment: DATABASE_URL: postgres://saleor:${POSTGRES_PASSWORD}@db:5432/saleor CACHE_URL: redis://cache:6379/0 CELERY_BROKER_URL: redis://cache:6379/1 SECRET_KEY: ${SECRET_KEY} ALLOWED_HOSTS: ${ALLOWED_HOSTS} ALLOWED_CLIENT_HOSTS: ${ALLOWED_CLIENT_HOSTS} DEFAULT_CHANNEL_SLUG: default-channel POPULATE_DEFAULTS: "True" ADMIN_PASSWORD: ${ADMIN_PASSWORD} DEBUG: "False" command: - /bin/sh - -c - | if [ ! -f /app/keys/jwt_key.pem ]; then python3 -c "from cryptography.hazmat.primitives.asymmetric import rsa; from cryptography.hazmat.primitives import serialization; k = rsa.generate_private_key(65537, 2048); open('/app/keys/jwt_key.pem', 'wb').write(k.private_bytes(serialization.Encoding.PEM, serialization.PrivateFormat.TraditionalOpenSSL, serialization.NoEncryption()))" chmod 600 /app/keys/jwt_key.pem fi export RSA_PRIVATE_KEY="$$(cat /app/keys/jwt_key.pem)" python3 manage.py migrate --no-input python3 manage.py shell -c "import os; from saleor.account.models import User, Group; from saleor.permission.enums import get_permissions; u, created = User.objects.get_or_create(email='[email protected]', defaults={'is_staff': True, 'is_superuser': True, 'is_active': True}); u.set_password(os.environ['ADMIN_PASSWORD']); u.is_staff = True; u.is_superuser = True; u.is_active = True; u.save(); g, _ = Group.objects.get_or_create(name='Full Access'); g.permissions.set(get_permissions()); g.user_set.add(u)" api: image: ghcr.io/saleor/saleor:3.23.45 ports: - "8000:8000" restart: unless-stopped depends_on: db: condition: service_healthy cache: condition: service_healthy init: condition: service_completed_successfully volumes: - saleor-media:/app/media - saleor-keys:/app/keys environment: DATABASE_URL: postgres://saleor:${POSTGRES_PASSWORD}@db:5432/saleor CACHE_URL: redis://cache:6379/0 CELERY_BROKER_URL: redis://cache:6379/1 SECRET_KEY: ${SECRET_KEY} ALLOWED_HOSTS: ${ALLOWED_HOSTS} ALLOWED_CLIENT_HOSTS: ${ALLOWED_CLIENT_HOSTS} DEFAULT_CHANNEL_SLUG: default-channel PUBLIC_URL: ${PUBLIC_URL} HTTP_IP_FILTER_ALLOW_LOOPBACK_IPS: "False" HTTP_IP_FILTER_ENABLED: "True" DEBUG: "False" command: - /bin/sh - -c - | export RSA_PRIVATE_KEY="$$(cat /app/keys/jwt_key.pem)" exec uvicorn saleor.asgi:application --host=0.0.0.0 --port=8000 --workers=2 --lifespan=auto --ws=none --no-server-header --no-access-log --timeout-keep-alive=35 --timeout-graceful-shutdown=30 --limit-max-requests=10000 healthcheck: test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/graphql/')"] interval: 10s timeout: 5s retries: 10 start_period: 30s worker: image: ghcr.io/saleor/saleor:3.23.45 restart: unless-stopped depends_on: cache: condition: service_healthy init: condition: service_completed_successfully volumes: - saleor-media:/app/media - saleor-keys:/app/keys environment: DATABASE_URL: postgres://saleor:${POSTGRES_PASSWORD}@db:5432/saleor CACHE_URL: redis://cache:6379/0 CELERY_BROKER_URL: redis://cache:6379/1 SECRET_KEY: ${SECRET_KEY} ALLOWED_HOSTS: ${ALLOWED_HOSTS} ALLOWED_CLIENT_HOSTS: ${ALLOWED_CLIENT_HOSTS} DEFAULT_CHANNEL_SLUG: default-channel PUBLIC_URL: ${PUBLIC_URL} DEBUG: "False" command: - /bin/sh - -c - | export RSA_PRIVATE_KEY="$$(cat /app/keys/jwt_key.pem)" exec celery -A saleor --app=saleor.celeryconf:app worker --loglevel=info -B dashboard: image: ghcr.io/saleor/saleor-dashboard:3.23.41 ports: - "9000:80" restart: unless-stopped depends_on: api: condition: service_healthy environment: API_URL: ${API_URL} db: image: postgres:15-alpine restart: unless-stopped environment: POSTGRES_USER: saleor POSTGRES_DB: saleor POSTGRES_PASSWORD: ${POSTGRES_PASSWORD} volumes: - saleor-db:/var/lib/postgresql/data healthcheck: test: ["CMD-SHELL", "pg_isready -U saleor -d saleor"] interval: 5s timeout: 5s retries: 5 cache: image: redis:7-alpine restart: unless-stopped volumes: - saleor-cache:/data healthcheck: test: ["CMD", "redis-cli", "ping"] interval: 5s timeout: 5s retries: 5 volumes: saleor-db: saleor-cache: saleor-media: saleor-keys:

dashboard-1 | 2026-11-01T09:52:26.113202125Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /stat.jsp?cmd=chcp+437+%7c+dir HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:26.113206792Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /index.php?option=com_canteen&controller=../../../../../etc/passwd%00 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1.1 Mobile/15E148 Safari/604.1" "-" dashboard-1 | 2026-11-01T09:52:26.125747542Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /contao/%22%3e%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:26.125828792Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /%22onload=alert%28document.domain%29;%3E HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:26.125834917Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /%22onload=alert%28document.domain%29;%3E HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (CentOS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:26.125837542Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /a/b/%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:26.125839417Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /a/b/%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/ Firefox/3.8" "-" dashboard-1 | 2026-11-01T09:52:26.125841000Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /src/read_body.php?mailbox=/etc/passwd&passed_id=1 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:26.125842917Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /source/loggin/page_log_dwn_file.hsp?h=44ea8a6603cbf54e245f37b4ddaf8f36&action=download&fileName=..\x5C..\x5C..\x5Cwindows\x5Cwin.ini HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_2) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/601.3.9" "-" dashboard-1 | 2026-11-01T09:52:26.125845042Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /src/read_body.php?mailbox=/etc/passwd&passed_id=1 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:26.125848333Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /duomiphp/ajax.php?action=addfav&id=1&uid=1%20and%20extractvalue(1,concat_ws(1,1,md5(999999999))) HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.4" "-" dashboard-1 | 2026-11-01T09:52:26.125850167Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /duomiphp/ajax.php?action=addfav&id=1&uid=1%20and%20extractvalue(1,concat_ws(1,1,md5(999999999))) HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0" "-" dashboard-1 | 2026-11-01T09:52:26.125863375Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /api/v1/files/profile_pictures/../secret_key HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15" "-" dashboard-1 | 2026-11-01T09:52:26.125871833Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /%252f%255cinteract.sh%252fa%253fb/ HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:26.125903375Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /api/v1/files/profile_pictures/../secret_key HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Debian; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:26.125906167Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /stat.jsp?cmd=chcp+437+%7c+dir HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; es-es) AppleWebKit/533.21.1 (KHTML, like Gecko) Version/5.0.5 Safari/533.21.1" "-" dashboard-1 | 2026-11-01T09:52:26.126047625Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /assets/other/service-account-credentials.json HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/3.8" "-" dashboard-1 | 2026-11-01T09:52:26.126203958Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /contao/%22%3e%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Gecko/20100101 Firefox/135.0" "-" dashboard-1 | 2026-11-01T09:52:26.128393958Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15" "-" dashboard-1 | 2026-11-01T09:52:26.128768000Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /wp-admin/setup-config.php?step=1 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:26.128977042Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /msa/../../../../../../../../etc/passwd HTTP/1.1" 400 157 "-" "-" "-" dashboard-1 | 2026-11-01T09:52:26.129045875Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /msa/../../../../../../../../etc/passwd HTTP/1.1" 400 157 "-" "-" "-" dashboard-1 | 2026-11-01T09:52:26.129430458Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /%252f%255cinteract.sh%252fa%253fb/ HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.8 Mobile/15E148 Safari/604.1" "-" dashboard-1 | 2026-11-01T09:52:26.129903333Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /mobile/plugin/CheckServer.jsp?type=mobileSetting HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:26.129987542Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /mobile/plugin/CheckServer.jsp?type=mobileSetting HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Knoppix; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:26.130070000Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /opensis/ajax.php?modname=misc/../../../../../../../../../../../../../etc/passwd&bypass=Transcripts.php HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0" "-" dashboard-1 | 2026-11-01T09:52:26.130139542Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /opensis/ajax.php?modname=misc/../../../../../../../../../../../../../etc/passwd&bypass=Transcripts.php HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:26.130234917Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko/20100101 Firefox/85.0" "-" dashboard-1 | 2026-11-01T09:52:26.130329625Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /wp-admin/setup-config.php?step=1 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/ Firefox/3.6.3" "-" dashboard-1 | 2026-11-01T09:52:26.130637917Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /iweboffice/officeserver.php?OPTION=LOADFILE&FILENAME=../mysql_config.ini HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" "-" dashboard-1 | 2026-11-01T09:52:26.130769917Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /client/index.php%3F.php/gsb/users.php HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.9.17" "-" dashboard-1 | 2026-11-01T09:52:26.130982917Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /client/index.php%3F.php/gsb/users.php HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:26.131175333Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /api/sms_check.php?param=1%27%20and%20updatexml(1,concat(0x7e,(SELECT%20md5(999999999)),0x7e),1)--%20 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0" "-" dashboard-1 | 2026-11-01T09:52:26.131311750Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /iweboffice/officeserver.php?OPTION=LOADFILE&FILENAME=../mysql_config.ini HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15" "-" dashboard-1 | 2026-11-01T09:52:26.131446750Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /index.php?option=com_cmimarketplace&Itemid=70&viewit=/../../../../../../etc/passwd&cid=1 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/ Firefox/3.6.10" "-" dashboard-1 | 2026-11-01T09:52:26.131980167Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /service-account-credentials.json HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0" "-" dashboard-1 | 2026-11-01T09:52:26.132221875Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /src/download.php?absolute_dl=true&passed_id=1&passed_ent_id=1&mailbox=/etc/passwd HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0" "-" dashboard-1 | 2026-11-01T09:52:26.132365417Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /src/download.php?absolute_dl=true&passed_id=1&passed_ent_id=1&mailbox=/etc/passwd HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 10.0; rv:140.0) Gecko/20100101 Firefox/140.0" "-" dashboard-1 | 2026-11-01T09:52:26.134805542Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /boards/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:26.134904333Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /boards/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Ubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:26.134917417Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /ajax.php?modname=misc/../../../../../../../../../../../../../etc/passwd&bypass=Transcripts.php HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:26.134958625Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /ajax.php?modname=misc/../../../../../../../../../../../../../etc/passwd&bypass=Transcripts.php HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0" "-" dashboard-1 | 2026-11-01T09:52:26.134982333Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /board/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:26.135301208Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /board/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh: Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15" "-" dashboard-1 | 2026-11-01T09:52:26.135421875Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /forum/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063" "-" dashboard-1 | 2026-11-01T09:52:26.135547625Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /forum/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Safari/605.1.15" "-" dashboard-1 | 2026-11-01T09:52:26.135793583Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /serviceAccountCredentials.json HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:26.135827250Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /forums/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16" "-" dashboard-1 | 2026-11-01T09:52:26.135849250Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /forums/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/11.0" "-" dashboard-1 | 2026-11-01T09:52:26.136035375Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /vb/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:26.136138250Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /vb/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 6.2; rv:140.) Gecko/20100101 Firefox/140." "-" dashboard-1 | 2026-11-01T09:52:26.136201250Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /index.php?option=com_canteen&controller=../../../../../etc/passwd%00 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9) Gecko/2008052906 Firefox/3.0" "-" dashboard-1 | 2026-11-01T09:52:26.136418917Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /assets/other/service-account-credentials.json HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:26.136481583Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /index.php?option=com_cmimarketplace&Itemid=70&viewit=/../../../../../../etc/passwd&cid=1 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1 Safari/605.1.15" "-" dashboard-1 | 2026-11-01T09:52:26.136694875Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /service-account-credentials.json HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:139.0) Gecko/20100101 Firefox/139.0" "-" dashboard-1 | 2026-11-01T09:52:26.136707125Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /serviceAccountCredentials.json HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:134.0) Gecko/20100101 Firefox/134.0" "-" dashboard-1 | 2026-11-01T09:52:26.142485375Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /html/2word?url=rjigq HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.4.21" "-" dashboard-1 | 2026-11-01T09:52:26.142504167Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /html/2word?url=rjigq HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Mobile/15E148 Safari/604.1" "-" dashboard-1 | 2026-11-01T09:52:26.143698167Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /defaultroot/download_old.jsp?path=..&name=x&FileName=WEB-INF/web.xml HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1.1 Safari/605.1.15" "-" dashboard-1 | 2026-11-01T09:52:26.143707875Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /defaultroot/download_old.jsp?path=..&name=x&FileName=WEB-INF/web.xml HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:26.148361375Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /dokuwiki/doku.php?id=wiki:welcome&at=<svg%20onload=alert(document.domain)> HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0" "-" dashboard-1 | 2026-11-01T09:52:26.148381042Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /dokuwiki/doku.php?id=wiki:welcome&at=<svg%20onload=alert(document.domain)> HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.17" "-" dashboard-1 | 2026-11-01T09:52:26.148824542Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /theme/default/img/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd HTTP/1.1" 400 157 "-" "-" "-" dashboard-1 | 2026-11-01T09:52:26.148834458Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /theme/default/img/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd HTTP/1.1" 400 157 "-" "-" "-" dashboard-1 | 2026-11-01T09:52:26.150974667Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET / HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 Thunderbird/140.0" "-" dashboard-1 | 2026-11-01T09:52:26.151413125Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET / HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0" "-" dashboard-1 | 2026-11-01T09:52:26.151426833Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /eos/ HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) ConnectPC Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:26.151486708Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /eos/ HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0" "-" dashboard-1 | 2026-11-01T09:52:26.154773667Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /api/v1/cluster/summary HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3" "-" dashboard-1 | 2026-11-01T09:52:26.155101125Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /api/v1/cluster/summary HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5_0) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15" "-" dashboard-1 | 2026-11-01T09:52:26.158357708Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../etc/passwd HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3.1 Safari/605.1.15" "-" dashboard-1 | 2026-11-01T09:52:26.158392833Z 192.168.65.74 - - [01/Nov/2026:09:52:26 +0000] "GET /ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../etc/passwd HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.112046126Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /jira/secure/BrowseProject.jspa?id=%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3e HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Safari/605.1.15" "-" dashboard-1 | 2026-11-01T09:52:27.112104126Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /jira/secure/BrowseProject.jspa?id=%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3e HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.133886501Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /CFIDE/debug/cf_debugFr.cfm?userPage=javascript:alert(1) HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.6.10" "-" dashboard-1 | 2026-11-01T09:52:27.133994209Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /index.php?option=com_smestorage&controller=../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Safari/605.1.15" "-" dashboard-1 | 2026-11-01T09:52:27.134000126Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /index.php?option=com_smestorage&controller=../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:101.0) Gecko/20100101 Firefox/101.0" "-" dashboard-1 | 2026-11-01T09:52:27.134002376Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /wp-content/plugins/tinymce-thumbnail-gallery/php/download-image.php?href=../../../../wp-config.php HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.134004001Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /wp-content/plugins/tinymce-thumbnail-gallery/php/download-image.php?href=../../../../wp-config.php HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.19.4 (KHTML, like Gecko) Version/5.0.2 Safari/533.18.5" "-" dashboard-1 | 2026-11-01T09:52:27.134020501Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /dbconsole/ HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15" "-" dashboard-1 | 2026-11-01T09:52:27.134023042Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /matchmakings/questiontmili%22%3E%3Cimg%20src%3da%20onerror%3dalert(document.domain)%3Ew71ch?number HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/18.17763" "-" dashboard-1 | 2026-11-01T09:52:27.135052042Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /dbconsole/ HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.135419334Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /index.php?rest_route=/whm/v3/themesettings HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134" "-" dashboard-1 | 2026-11-01T09:52:27.135433042Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /matchmakings/questiontmili%22%3E%3Cimg%20src%3da%20onerror%3dalert(document.domain)%3Ew71ch?number HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.135592584Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /CFIDE/debug/cf_debugFr.cfm?userPage=javascript:alert(1) HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Knoppix; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.135682542Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /overview.asp HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0" "-" dashboard-1 | 2026-11-01T09:52:27.135684292Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /api?path=files&id=dfsse%3Cimg%20src%3da%20onerror%3dalert(document.domain)%3Ez1668cyj2pi&revision=%22%22&type=%22thumb%22&command=url&expires=1687785968527 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15" "-" dashboard-1 | 2026-11-01T09:52:27.135685709Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /api?path=files&id=dfsse%3Cimg%20src%3da%20onerror%3dalert(document.domain)%3Ez1668cyj2pi&revision=%22%22&type=%22thumb%22&command=url&expires=1687785968527 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.135686626Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /wp-content/plugins/socialfit/popup.php?service=googleplus&msg=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.135687459Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /wp-content/plugins/socialfit/popup.php?service=googleplus&msg=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; ClaudeBot/1.0; [email protected])" "-" dashboard-1 | 2026-11-01T09:52:27.135715376Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /overview.asp HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.135765876Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /NCFindWeb?service=IPreAlertConfigService&filename HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.135844667Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /NCFindWeb?service=IPreAlertConfigService&filename HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.135929001Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /sensorlist.htm HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.135974584Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /sensorlist.htm HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1 Safari/605.1.15" "-" dashboard-1 | 2026-11-01T09:52:27.136001542Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /h2-console/ HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.8" "-" dashboard-1 | 2026-11-01T09:52:27.136052292Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /index.php?rest_route=/whm/v3/themesettings HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.3 Safari/605.1.15" "-" dashboard-1 | 2026-11-01T09:52:27.136119042Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /pages/includes/status-list-mo%3Ciframe%20src%3D%22javascript%3Aalert%28document.domain%29%22%3E.vm HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15" "-" dashboard-1 | 2026-11-01T09:52:27.136120584Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /pages/includes/status-list-mo%3Ciframe%20src%3D%22javascript%3Aalert%28document.domain%29%22%3E.vm HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.136263251Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /command/prima-factory.cgi HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0" "-" dashboard-1 | 2026-11-01T09:52:27.136330001Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /command/prima-factory.cgi HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.5 Safari/605.1.15" "-" dashboard-1 | 2026-11-01T09:52:27.136331584Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /index.php?option=com_perchaimageattach&controller=../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:84.0) Gecko/20100101 Firefox/84.0" "-" dashboard-1 | 2026-11-01T09:52:27.136332459Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /index.php?option=com_perchaimageattach&controller=../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.136356417Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /upload/setup/install.php HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0" "-" dashboard-1 | 2026-11-01T09:52:27.136376584Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /upload/setup/install.php HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (X11; CrOS x86_64 14816.131.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.136410042Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /webmail/?color=\x22><img+src=x+onerror=confirm(document.domain)> HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Version/15.5 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.136448459Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /webmail/?color=\x22><img+src=x+onerror=confirm(document.domain)> HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (CentOS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.136496292Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /web/login?error=<script>alert(document.domain)</script> HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:58.0) Gecko/20100101 Firefox/59.0" "-" dashboard-1 | 2026-11-01T09:52:27.136521334Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /web/login?error=<script>alert(document.domain)</script> HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.136607334Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /admin/?n=product&c=product_admin&a=dopara&app_type=shop&id=1%20union%20SELECT%201,2,3,25367*75643,5,6,7%20limit%205,1%20%23 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134" "-" dashboard-1 | 2026-11-01T09:52:27.136686417Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /admin/?n=product&c=product_admin&a=dopara&app_type=shop&id=1%20union%20SELECT%201,2,3,25367*75643,5,6,7%20limit%205,1%20%23 HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10" "-" dashboard-1 | 2026-11-01T09:52:27.136688126Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /cfusion/debug/cf_debugFr.cfm?userPage=javascript:alert(1) HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:104.0) Gecko/20100101 Firefox/104.0" "-" dashboard-1 | 2026-11-01T09:52:27.136752959Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /h2-console/ HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Ubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.136754251Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /cfusion/debug/cf_debugFr.cfm?userPage=javascript:alert(1) HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.140021042Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /web/signup?error=<img/src=x+onerror=alert(document.domain)> HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.140100251Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /setup/install.php HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.140131417Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /setup/install.php HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.140220126Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /web/signup?error=<img/src=x+onerror=alert(document.domain)> HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.140504001Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /web/reset_password?error=<svg/onload=alert(document.domain)> HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Version/15.2 Safari/537.36" "-" dashboard-1 | 2026-11-01T09:52:27.140564917Z 192.168.65.74 - - [01/Nov/2026:09:52:27 +0000] "GET /web/reset_password?error=<svg/onload=alert(document.domain)> HTTP/1.1" 200 5304 "-" "Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" "-"

Saleor

Overview

Why Saleor instead of Shopify

What it does well

Similar Open Source Tools

Medusa

Limitations

Who should use it

FAQ

Verdict

Self-host Saleor with Docker

Download the compose file

Create .env with fresh secrets

Start it

First run

Project README

GitHub Repository Metrics

Supported Platforms

Maintainer? Add the badge

Bagisto

WooCommerce