Zen-cart

Zen Cart

28 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.8

CVE-2008-6986

Exploit
  • EPSS 2.81%
  • Veröffentlicht 19.08.2009 05:24:52
  • Zuletzt bearbeitet 16.06.2026 23:03:22

SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shopping_cart.php in Zen Cart 1.3.0 through 1.3.8a, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the products...

6.8

CVE-2008-6985

Exploit
  • EPSS 1.58%
  • Veröffentlicht 19.08.2009 05:24:52
  • Zuletzt bearbeitet 16.06.2026 23:03:22

Multiple SQL injection vulnerabilities in includes/classes/shopping_cart.php in Zen Cart 1.2.0 through 1.3.8a, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter when (1) adding or (2) upd...

6.8

CVE-2009-2255

Exploit
  • EPSS 30.97%
  • Veröffentlicht 30.06.2009 10:30:19
  • Zuletzt bearbeitet 16.06.2026 23:09:04

Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which allows remote attackers to execute arbitrary code by uploading a .php file via the record_company_image parameter in conjunction wi...

7.5

CVE-2009-2254

Exploit
  • EPSS 10.89%
  • Veröffentlicht 30.06.2009 10:30:11
  • Zuletzt bearbeitet 16.06.2026 23:09:04

Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows remote attackers to execute arbitrary SQL commands via the query_string parameter in an execute action, in conjunction with a PATH...

4.3

CVE-2008-6616

Exploit
  • EPSS 1.44%
  • Veröffentlicht 06.04.2009 18:30:00
  • Zuletzt bearbeitet 16.06.2026 23:02:38

Cross-site scripting (XSS) vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in the advanced_search_result page. NOTE: the provenance of this information ...

7.5

CVE-2008-6615

Exploit
  • EPSS 0.96%
  • Veröffentlicht 06.04.2009 18:30:00
  • Zuletzt bearbeitet 16.06.2026 23:02:37

SQL injection vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to execute arbitrary SQL commands via the keyword parameter in the advanced_search_result page. NOTE: the provenance of this information is unknown; the d...

10

CVE-2006-0697

  • EPSS 5.24%
  • Veröffentlicht 15.02.2006 11:06:00
  • Zuletzt bearbeitet 16.06.2026 22:21:06

Zen Cart before 1.2.7 does not protect the admin/includes directory, which allows remote attackers to cause unknown impact via unspecified vectors, probably direct requests.

5.1

CVE-2005-3996

Exploit
  • EPSS 1.93%
  • Veröffentlicht 05.12.2005 00:03:00
  • Zuletzt bearbeitet 16.06.2026 22:18:01

SQL injection vulnerability in admin/password_forgotten.php in Zen Cart 1.2.6d and earlier allows remote attackers to execute arbitrary SQL commands via the admin_email parameter.