Zen-cart

Zen Cart

28 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.8

CVE-2012-5805

Exploit
  • EPSS 0.13%
  • Published 04.11.2012 22:55:04
  • Last modified 11.04.2025 00:51:21

The PayPal IPN functionality in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers ...

5.8

CVE-2012-5808

Exploit
  • EPSS 0.13%
  • Published 04.11.2012 22:55:04
  • Last modified 11.04.2025 00:51:21

The LinkPoint module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an a...

5.8

CVE-2012-5807

Exploit
  • EPSS 0.13%
  • Published 04.11.2012 22:55:04
  • Last modified 11.04.2025 00:51:21

The Authorize.Net eCheck module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL serve...

5.8

CVE-2012-5806

Exploit
  • EPSS 0.13%
  • Published 04.11.2012 22:55:04
  • Last modified 11.04.2025 00:51:21

The PayPal Payments Pro module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL server...

2.6

CVE-2012-1413

  • EPSS 0.23%
  • Published 27.05.2012 19:55:01
  • Last modified 11.04.2025 00:51:21

Cross-site scripting (XSS) vulnerability in zc_install/includes/modules/pages/database_setup/header_php.php in Zen Cart 1.5.0 and earlier, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the db...

4.3

CVE-2011-4567

Exploit
  • EPSS 0.38%
  • Published 29.11.2011 00:55:01
  • Last modified 11.04.2025 00:51:21

Cross-site scripting (XSS) vulnerability in includes/templates/template_default/templates/tpl_gv_send_default.php in Zen Cart before 1.5 allows remote attackers to inject arbitrary web script or HTML via the message parameter in a gv_send action to i...

4.3

CVE-2011-4547

Exploit
  • EPSS 0.25%
  • Published 29.11.2011 00:55:01
  • Last modified 11.04.2025 00:51:21

Multiple cross-site scripting (XSS) vulnerabilities in includes/templates/template_default/common/tpl_header_test_info.php in Zen Cart 1.3.9h, when debugging is enabled, might allow remote attackers to inject arbitrary web script or HTML via the (1) ...

7.5

CVE-2009-4323

  • EPSS 0.46%
  • Published 14.12.2009 23:30:00
  • Last modified 09.04.2025 00:30:58

The installation for Zen Cart stores sensitive information and insecure programs under the (1) docs, (2) extras, and (3) zc_install folders, and (4) install.txt, which allows remote attackers to obtain sensitive information, delete the database, and ...

5

CVE-2009-4322

Exploit
  • EPSS 0.28%
  • Published 14.12.2009 23:30:00
  • Last modified 09.04.2025 00:30:58

extras/ipn_test_return.php in Zen Cart allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message.

5

CVE-2009-4321

Exploit
  • EPSS 0.82%
  • Published 14.12.2009 23:30:00
  • Last modified 09.04.2025 00:30:58

extras/curltest.php in Zen Cart 1.3.8 and 1.3.8a, and possibly other versions, allows remote attackers to read arbitrary files via a file:// URI. NOTE: some of these details are obtained from third party information.