3 results (0.004 seconds)

CVSS: 2.6EPSS: 0%CPEs: 25EXPL: 0

CVE-2012-1413

https://notcve.org/view.php?id=CVE-2012-1413

Cross-site scripting (XSS) vulnerability in zc_install/includes/modules/pages/database_setup/header_php.php in Zen Cart 1.5.0 and earlier, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the db_username parameter to zc_install/index.php. Vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en zc_install/includes/modules/pages/database_setup/header_php.php en Zen Cart 1.5.0 y anteriores cuando el software está siendo instalado, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro de db_username zc_install / index.php. • https://www.trustwave.com/spiderlabs/advisories/TWSL2012-004.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 3

CVE-2008-6616 – Zen Cart 2008 - 'index.php?keyword' Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2008-6616

Cross-site scripting (XSS) vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in the advanced_search_result page. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en index.php en Zen Software Zen Cart 2008 permite a atacantes remotos inyectar web script o HTML de su elección a través del parámetro "keyword" en la página advanced_search_result. NOTA: la procedencia de esta información es desconocida; los detalles han sido obtenidos solamente a partir de la información de terceros. • https://www.exploit-db.com/exploits/31726 http://downloads.securityfocus.com/vulnerabilities/exploits/29020.html http://www.securityfocus.com/bid/29020 https://exchange.xforce.ibmcloud.com/vulnerabilities/42162 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 3

CVE-2008-6615 – Zen Cart 2008 - 'index.php?keyword' SQL Injection

https://notcve.org/view.php?id=CVE-2008-6615

SQL injection vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to execute arbitrary SQL commands via the keyword parameter in the advanced_search_result page. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Vulnerabilidad de inyección SQL en index.php en Zen Software Zen Cart 2008 permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro "keyword" en la página advanced_search_result. NOTA: la procedencia de esta información es desconocida; los detalles han sido obtenidos solamente a partir de la información de terceros. • https://www.exploit-db.com/exploits/31725 http://downloads.securityfocus.com/vulnerabilities/exploits/29020.html http://www.securityfocus.com/bid/29020 https://exchange.xforce.ibmcloud.com/vulnerabilities/42161 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •