Qualiteam

X-cart

15 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2019-7220

Exploit
  • EPSS 0.27%
  • Veröffentlicht 06.06.2019 16:29:01
  • Zuletzt bearbeitet 21.11.2024 04:47:46

X-Cart V5 is vulnerable to XSS via the CategoryFilter2 parameter.

8.8

CVE-2017-15285

Exploit
  • EPSS 2.08%
  • Veröffentlicht 12.10.2017 08:29:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

X-Cart 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 is vulnerable to Remote Code Execution. This vulnerability exists because the application fails to check remote file extensions before saving locally. This vulnerability can be exploited by anyone with Vend...

4.3

CVE-2015-5455

Exploit
  • EPSS 0.23%
  • Veröffentlicht 08.07.2015 15:59:07
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in X-Cart 4.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to install/.

6.5

CVE-2015-0951

  • EPSS 0.4%
  • Veröffentlicht 05.04.2015 01:59:05
  • Zuletzt bearbeitet 12.04.2025 10:46:40

X-Cart before 5.1.11 allows remote authenticated users to read or delete address data of arbitrary accounts via a modified (1) update or (2) remove request.

4.3

CVE-2015-0950

  • EPSS 0.69%
  • Veröffentlicht 05.04.2015 01:59:03
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in admin.php in X-Cart 5.1.6 through 5.1.10 allows remote attackers to inject arbitrary web script or HTML via the substring parameter.

4.3

CVE-2015-1178

Exploit
  • EPSS 0.25%
  • Veröffentlicht 26.01.2015 15:59:13
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Multiple cross-site scripting (XSS) vulnerabilities in cart.php in X-Cart 5.1.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) product_id or (2) category_id parameter.

4.3

CVE-2012-2570

Exploit
  • EPSS 2.43%
  • Veröffentlicht 15.08.2012 20:55:01
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Cross-site scripting (XSS) vulnerability in products_map.php in X-Cart Gold 4.5 allows remote attackers to inject arbitrary web script or HTML via the symb parameter.

7.5

CVE-2007-4907

Exploit
  • EPSS 8.35%
  • Veröffentlicht 17.09.2007 16:17:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Multiple PHP remote file inclusion vulnerabilities in X-Cart allow remote attackers to execute arbitrary PHP code via a URL in the xcart_dir parameter to (1) config.php, (2) prepare.php, (3) smarty.php, (4) customer/product.php, (5) provider/auth.php...

7.5

CVE-2006-4904

  • EPSS 2.88%
  • Veröffentlicht 21.09.2006 00:07:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

Dynamic variable evaluation vulnerability in cmpi.php in Qualiteam X-Cart 4.1.3 and earlier allows remote attackers to overwrite arbitrary program variables and execute arbitrary PHP code, as demonstrated by PHP remote file inclusion via the xcart_di...

6.4

CVE-2006-2827

  • EPSS 0.78%
  • Veröffentlicht 05.06.2006 17:02:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

SQL injection vulnerability in search.php in X-Cart Gold and Pro 4.0.18, and X-Cart 4.1.0 beta 1, allows remote attackers to execute arbitrary SQL commands via the "Search for pattern" field, when the settings specify only "Search in Detailed descrip...