Zen-cart Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/zen-cart/ Sun, 26 Feb 2023 09:11:48 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png Zen-cart Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/zen-cart/ 32 32 CVE-2008-6985 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-6985/ Sun, 26 Feb 2023 09:11:48 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-6985/ Multiple SQL injection vulnerabilities in includes/classes/shopping_cart.php in Zen Cart 1.2.0 through 1.3.8a, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter when (1) adding or (2) updating the shopping cart.

The post CVE-2008-6985 appeared first on CVE Vulnerability.

]]> Multiple SQL injection vulnerabilities in includes/classes/shopping_cart.php in Zen Cart 1.2.0 through 1.3.8a, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter when (1) adding or (2) updating the shopping cart.

The post CVE-2008-6985 appeared first on CVE Vulnerability.

]]> CVE-2008-6986 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-6986/ Sun, 26 Feb 2023 09:11:48 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-6986/ SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shopping_cart.php in Zen Cart 1.3.0 through 1.3.8a, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the products_id array parameter in a multiple_products_add_product action, a different vulnerability than CVE-2008-6985.

The post CVE-2008-6986 appeared first on CVE Vulnerability.

]]> SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shopping_cart.php in Zen Cart 1.3.0 through 1.3.8a, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the products_id array parameter in a multiple_products_add_product action, a different vulnerability than CVE-2008-6985.

The post CVE-2008-6986 appeared first on CVE Vulnerability.

]]> CVE-2008-6877 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-6877/ Sun, 26 Feb 2023 09:11:45 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-6877/ ** DISPUTED ** Directory traversal vulnerability in admin/includes/initsystem.php in Zen Cart 1.3.8 and 1.3.8a, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the loader_file parameter. NOTE: the vendor disputes this issue, stating “at worst, the use of this vulnerability will reveal some […]

The post CVE-2008-6877 appeared first on CVE Vulnerability.

]]> ** DISPUTED ** Directory traversal vulnerability in admin/includes/initsystem.php in Zen Cart 1.3.8 and 1.3.8a, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the loader_file parameter. NOTE: the vendor disputes this issue, stating “at worst, the use of this vulnerability will reveal some local file paths.”

The post CVE-2008-6877 appeared first on CVE Vulnerability.

]]> CVE-2008-6878 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-6878/ Sun, 26 Feb 2023 09:11:45 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-6878/ ** DISPUTED ** Directory traversal vulnerability in admin/includes/languages/english.php in Zen Cart 1.3.8a, 1.3.8, and earlier, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the _SESSION[language] parameter. NOTE: the vendor disputes this issue, stating “at worst, the use of this vulnerability will reveal […]

The post CVE-2008-6878 appeared first on CVE Vulnerability.

]]> ** DISPUTED ** Directory traversal vulnerability in admin/includes/languages/english.php in Zen Cart 1.3.8a, 1.3.8, and earlier, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the _SESSION[language] parameter. NOTE: the vendor disputes this issue, stating “at worst, the use of this vulnerability will reveal some local file paths.”

The post CVE-2008-6878 appeared first on CVE Vulnerability.

]]> CVE-2008-6615 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-6615/ Sun, 26 Feb 2023 09:11:37 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-6615/ SQL injection vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to execute arbitrary SQL commands via the keyword parameter in the advanced_search_result page. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

The post CVE-2008-6615 appeared first on CVE Vulnerability.

]]> SQL injection vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to execute arbitrary SQL commands via the keyword parameter in the advanced_search_result page. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

The post CVE-2008-6615 appeared first on CVE Vulnerability.

]]> CVE-2008-6616 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-6616/ Sun, 26 Feb 2023 09:11:37 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-6616/ Cross-site scripting (XSS) vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in the advanced_search_result page. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

The post CVE-2008-6616 appeared first on CVE Vulnerability.

]]> Cross-site scripting (XSS) vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in the advanced_search_result page. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

The post CVE-2008-6616 appeared first on CVE Vulnerability.

]]> CVE-2020-6578 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-6578/ Sun, 26 Feb 2023 06:42:48 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-6578/ Zen Cart 1.5.6d allows reflected XSS via the main_page parameter to includes/templates/template_default/common/tpl_main_page.php or includes/templates/responsive_classic/common/tpl_main_page.php.

The post CVE-2020-6578 appeared first on CVE Vulnerability.

]]> Zen Cart 1.5.6d allows reflected XSS via the main_page parameter to includes/templates/template_default/common/tpl_main_page.php or includes/templates/responsive_classic/common/tpl_main_page.php.

The post CVE-2020-6578 appeared first on CVE Vulnerability.

]]> CVE-2021-3291 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-3291/ Thu, 23 Feb 2023 14:09:53 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-3291/ Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.

The post CVE-2021-3291 appeared first on CVE Vulnerability.

]]> Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.

The post CVE-2021-3291 appeared first on CVE Vulnerability.

]]>