CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2011-4547
https://notcve.org/view.php?id=CVE-2011-4547
Multiple cross-site scripting (XSS) vulnerabilities in includes/templates/template_default/common/tpl_header_test_info.php in Zen Cart 1.3.9h, when debugging is enabled, might allow remote attackers to inject arbitrary web script or HTML via the (1) main_page parameter or (2) PATH_INFO, a different vulnerability than CVE-2011-4567. Multiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en includes/templates/template_default/common/tpl_header_test_info.php en Zen Cart v1.3.9h, cuando esté habilitada la depuración, podría permitir a atacantes remotos inyectar HTML o secuencias de comandos HTML a través de (1) el parámetro Main_Page o (2) la variable PATH_INFO. Se trata de una vulnerabilidad diferente a CVE-2011-4567. • http://www.securityfocus.com/bid/50787 https://exchange.xforce.ibmcloud.com/vulnerabilities/71519 https://www.dognaedis.com/vulns/DGS-SEC-9.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 35%CPEs: 2EXPL: 1CVE-2009-4321
https://notcve.org/view.php?id=CVE-2009-4321
extras/curltest.php in Zen Cart 1.3.8 and 1.3.8a, and possibly other versions, allows remote attackers to read arbitrary files via a file:// URI. NOTE: some of these details are obtained from third party information. extras/curltest.php en Zen Cart v1.3.8 y v1.3.8a, y posiblemente otras versiones, permite a atacantes remotos leer ficheros arbitrarios a través de un fichero file:// URI. NOTA: Algunos de los detalles fueron obtenidos de terceras partes. • http://osvdb.org/60892 http://secunia.com/advisories/37630 http://www.acunetix.com/blog/websecuritynews/acusensor-curl-and-zen-cart http://www.securityfocus.com/archive/1/508340/100/0/threaded http://www.securityfocus.com/bid/37283 http://www.vupen.com/english/advisories/2009/3474 http://www.zen-cart.com/forum/showthread.php?t=142784 https://exchange.xforce.ibmcloud.com/vulnerabilities/54687 • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 2CVE-2009-4322
https://notcve.org/view.php?id=CVE-2009-4322
extras/ipn_test_return.php in Zen Cart allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message. extras/ipn_test_return.php in Zen Cart permite a atacantes remotos obtener información sensible a través de una petición, lo que permite descubrir la ruta de instalación en un mensaje de error. • http://www.acunetix.com/blog/websecuritynews/acusensor-curl-and-zen-cart http://www.securityfocus.com/archive/1/508340/100/0/threaded http://www.zen-cart.com/forum/showthread.php?t=142784 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2009-4323
https://notcve.org/view.php?id=CVE-2009-4323
The installation for Zen Cart stores sensitive information and insecure programs under the (1) docs, (2) extras, and (3) zc_install folders, and (4) install.txt, which allows remote attackers to obtain sensitive information, delete the database, and conduct other attacks via a direct request, different vulnerabilities than CVE-2009-4321 and CVE-2009-4322. La instalacion para Zen Cart almacena informacion sensible y progrmas inseguros bajo (1) docs, (2) extras, y (3) zc_install folders, y (4) install.txt, lo que permite a atacantes remotos obtener informacion sensible, borrar la base de datos, y dirigir otros ataques a traves de una peticion directa, una vulnerabilidad diferente de CVE-2009-4321 y CVE-2009-4322. • http://www.zen-cart.com/forum/showthread.php?t=142784 •
CVSS: 6.8EPSS: 0%CPEs: 8EXPL: 1CVE-2008-6986
https://notcve.org/view.php?id=CVE-2008-6986
SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shopping_cart.php in Zen Cart 1.3.0 through 1.3.8a, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the products_id array parameter in a multiple_products_add_product action, a different vulnerability than CVE-2008-6985. Vulnerabilidad de inyección SQL en la función actionMultipleAddProduct en includes/classes/shopping_cart.php en Zen Cartv v1.3.0 hasta v1.3.8a, cuando magic_quotes_gpc es desactivada, permite a atacantes remotos ejecutar comandos SQL a su elección a través del parámetro products_id en una acción multiple_products_add_product, una vulnerabilidad diferente a CVE-2008-6985. • http://secunia.com/advisories/31758 http://www.gulftech.org/?node=research&article_id=00129-09042008 http://www.osvdb.org/48347 http://www.securityfocus.com/archive/1/496002/100/0/threaded http://www.securityfocus.com/archive/1/496032/100/100/threaded http://www.securityfocus.com/bid/31023 http://www.zen-cart.com/forum/showthread.php?p=604473 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •