CVSS: 2.6EPSS: 0%CPEs: 25EXPL: 0CVE-2012-1413
https://notcve.org/view.php?id=CVE-2012-1413
Cross-site scripting (XSS) vulnerability in zc_install/includes/modules/pages/database_setup/header_php.php in Zen Cart 1.5.0 and earlier, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the db_username parameter to zc_install/index.php. Vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en zc_install/includes/modules/pages/database_setup/header_php.php en Zen Cart 1.5.0 y anteriores cuando el software está siendo instalado, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro de db_username zc_install / index.php. • https://www.trustwave.com/spiderlabs/advisories/TWSL2012-004.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 20EXPL: 2CVE-2011-4567 – Zen Cart CMS 1.3.9h - Multiple Cross-Site Scripting Vulnerabilities
https://notcve.org/view.php?id=CVE-2011-4567
Cross-site scripting (XSS) vulnerability in includes/templates/template_default/templates/tpl_gv_send_default.php in Zen Cart before 1.5 allows remote attackers to inject arbitrary web script or HTML via the message parameter in a gv_send action to index.php, a different vulnerability than CVE-2011-4547. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en en includes/templates/template_default/templates/tpl_gv_send_default.php en Zen Cart antes de v1.5 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro del mensaje en una acción gv_send a index.php. Se trata de una vulnerabilidad diferente a CVE-2011 hasta 4.547. • https://www.exploit-db.com/exploits/36346 http://www.securityfocus.com/bid/50787 https://exchange.xforce.ibmcloud.com/vulnerabilities/71519 https://www.dognaedis.com/vulns/DGS-SEC-8.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 9%CPEs: 9EXPL: 3CVE-2009-2254 – Zen Cart 1.3.8 - SQL Execution
https://notcve.org/view.php?id=CVE-2009-2254
Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows remote attackers to execute arbitrary SQL commands via the query_string parameter in an execute action, in conjunction with a PATH_INFO of password_forgotten.php, related to a "SQL Execution" issue. Zen Cart v1.3.8a, v1.3.8 y anteriores no solicita una autenticación administrativa para admin/sqlpatch.php, lo que permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro "query_string" en una ejecución, en conjunción con un PATH_INFO de password_forgotten.php, relacionado con el caso "ejecución SQL". • https://www.exploit-db.com/exploits/9005 http://secunia.com/advisories/35550 http://www.exploit-db.com/exploits/9005 http://www.osvdb.org/55343 http://www.securityfocus.com/bid/35468 http://www.zen-cart.com/forum/attachment.php?attachmentid=5965 http://www.zen-cart.com/forum/showthread.php?t=130161 https://exchange.xforce.ibmcloud.com/vulnerabilities/51317 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.8EPSS: 30%CPEs: 9EXPL: 3CVE-2009-2255 – Zen Cart 1.3.8 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2009-2255
Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which allows remote attackers to execute arbitrary code by uploading a .php file via the record_company_image parameter in conjunction with a PATH_INFO of password_forgotten.php, then accessing this file via a direct request to the file in images/. Zen Cart v1.3.8a, v1.3.8 y anteriores no requiere autenticación como administrador para el acceso a admin/record_company.php, lo que permite a atacantes remotos ejecutar código de su elección subiendo un archivo php a través del parámetro "record_company_image" junto con "PATH_INFO" de password_forgotten.php, y después accediendo a este archivo a través de una petición directa al fichero en images/. • https://www.exploit-db.com/exploits/9004 http://secunia.com/advisories/35550 http://www.exploit-db.com/exploits/9004 http://www.osvdb.org/55344 http://www.securityfocus.com/bid/35467 http://www.zen-cart.com/forum/attachment.php?attachmentid=5965 http://www.zen-cart.com/forum/showthread.php?t=130161 https://exchange.xforce.ibmcloud.com/vulnerabilities/51316 • CWE-287: Improper Authentication •
CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2007-3597
https://notcve.org/view.php?id=CVE-2007-3597
Session fixation vulnerability in Zen Cart 1.3.7 and earlier allows remote attackers to hijack web sessions by setting the Cookie parameter. Vulnerabilidad de fijación de sesión en Zen Cart 1.3.7 y versiones anteriores permite a atacantes remotos secuestrar sesiones web utilizando el parámetro Cookie. • http://osvdb.org/37836 http://secunia.com/advisories/25942 http://securityreason.com/securityalert/2866 http://sourceforge.net/project/shownotes.php?release_id=474574&group_id=83781 http://superb-east.dl.sourceforge.net/sourceforge/zencart/zen-cart-v1.3.7-admin-patch.zip http://www.securityfocus.com/archive/1/472875/100/0/threaded • CWE-287: Improper Authentication •