Zen-cart Zen_cart
27 CVEs affecting Zen-cart Zen_cart. Latest disclosed: 2024-08-21. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-8352 | Critical | 9.8 | 2017-08-24 | Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act paramete… |
CVE-2017-11675 | High | 8.8 | 2017-07-27 | The traverseStrictSanitize function in admin_dir/includes/classes/AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which allows remote authe… |
CVE-2024-5762 | High | 8.1 | 2024-08-21 | Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2021-3291 | High | 7.2 | 2021-01-26 | Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command. |
CVE-2020-6578 | Medium | 6.1 | 2021-03-19 | Zen Cart 1.5.6d allows reflected XSS via the main_page parameter to includes/templates/template_default/common/tpl_main_page.php or includes/templates/responsi… |
CVE-2017-10667 | Medium | 6.1 | 2017-06-29 | In index.php in Zen Cart 1.6.0, the products_id parameter can cause XSS. |
CVE-2017-8833 | Medium | 6.1 | 2017-05-08 | Zen Cart 1.6.0 has XSS in the main_page parameter to index.php. NOTE: 1.6.0 is not an official release but the vendor's README.md file offers a link to v160.zi… |
CVE-2011-4403 | | 2015-04-24 | Multiple cross-site request forgery (CSRF) vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for request… | |
CVE-2015-0882 | | 2015-02-27 | Multiple cross-site scripting (XSS) vulnerabilities in zencart-ja (aka Zen Cart Japanese edition) 1.3 jp through 1.3.0.2 jp8 and 1.5 ja through 1.5.1 ja allow… | |
CVE-2012-5808 | | 2012-11-04 | The LinkPoint module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of th… | |
CVE-2012-5807 | | 2012-11-04 | The Authorize.Net eCheck module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName… | |
CVE-2012-5806 | | 2012-11-04 | The PayPal Payments Pro module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName f… | |
CVE-2012-5805 | | 2012-11-04 | The PayPal IPN functionality in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName fie… | |
CVE-2012-1413 | | 2012-05-27 | Cross-site scripting (XSS) vulnerability in zc_install/includes/modules/pages/database_setup/header_php.php in Zen Cart 1.5.0 and earlier, when the software is… | |
CVE-2011-4567 | | 2011-11-29 | Cross-site scripting (XSS) vulnerability in includes/templates/template_default/templates/tpl_gv_send_default.php in Zen Cart before 1.5 allows remote attacker… | |
CVE-2011-4547 | | 2011-11-29 | Multiple cross-site scripting (XSS) vulnerabilities in includes/templates/template_default/common/tpl_header_test_info.php in Zen Cart 1.3.9h, when debugging i… | |
CVE-2009-4323 | | 2009-12-14 | The installation for Zen Cart stores sensitive information and insecure programs under the (1) docs, (2) extras, and (3) zc_install folders, and (4) install.tx… | |
CVE-2009-4322 | | 2009-12-14 | extras/ipn_test_return.php in Zen Cart allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an… | |
CVE-2009-4321 | | 2009-12-14 | extras/curltest.php in Zen Cart 1.3.8 and 1.3.8a, and possibly other versions, allows remote attackers to read arbitrary files via a file:// URI. NOTE: some o… | |
CVE-2008-6986 | | 2009-08-19 | SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shopping_cart.php in Zen Cart 1.3.0 through 1.3.8a, when magic_quotes_… |