X-Cart 4.1.3 - Arbitrary Variable Overwrite

X-Cart 4.1.3 - Arbitrary Variable Overwrite X-Cart Arbitrary Variable Overwrite Vendor: Qualiteam Product: X-Cart Version: $value $$var = $value; As we can see every single post variable is dynamically evaluated. This is especially dangerous because register globals and magic quotes gpc settings ...

X-Cart < 4.1.3 - Arbitrary Variable Overwrite

X-Cart Arbitrary Variable Overwrite Vendor: Qualiteam Product: X-Cart Version: $value $$var = $value; As we can see every single post variable is dynamically evaluated. This is especially dangerous because register globals and magic quotes gpc settings do not affect an attackers ability to...

X_CART Shopping Cart Version Detection

Detects the installed version of XCART Shopping Cart. This script sends an HTTP GET request and tries to get the version from the response. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

X_CART Installation Script Cross Site Scripting Vulnerability

XCART is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:qualiteam:x-cart";...

Creative X-Cart Cross-Site Scripting Vulnerability

Creative X-Cart is a Russian company Creative open source PHP e-commerce software . The software provides favorites , order records and inventory management modules. A cross-site scripting vulnerability exists in Creative X-Cart 4.5.0 and earlier versions. A remote attacker can exploit this...

CVE-2015-5455

Cross-site scripting XSS vulnerability in X-Cart 4.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to install/...

Cross site scripting

Cross-site scripting XSS vulnerability in X-Cart 4.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to install/...

CVE-2015-5455

Cross-site scripting XSS vulnerability in X-Cart 4.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to install/...

CVE-2015-5455

CVE-2015-5455 targets X-Cart, specifically version 4.5.0 and earlier. The vulnerability is described as a cross-site scripting (XSS) issue that could allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the install/ directory. The connected documents confirm th...

X-Cart 4.5.0 Cross Site Scripting

Exploit Title: X-Cart Cross Site Scripting Date: 30/06/2015 Exploit Author: nopesled Vendor Homepage: http://www.x-cart.com/ Version: 4.5.0 and possibly earlier Details ------- Websites running X-Cart version 4.5.0 and possibly below which have not removed their /install/ directory are vulnerable...

X_CART Multiple Cross Site Scripting Vulnerabilities

XCART is prone to multiple cross site scripting vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:qualiteam:x-cart...

X-Cart Cross-Site Scripting Vulnerability (CNVD-2015-02183)

X-Cart is an open source PHP e-commerce software . The software provides favorites , order records and inventory management modules. A cross-site scripting vulnerability exists in the admin.php script in X-Cart versions 5.1.6 through 5.1.10. A remote attacker can exploit this vulnerability to...

X-Cart Privilege Access Vulnerability

X-Cart is an open source PHP e-commerce software . The software provides favorites , order records and inventory management modules. A security vulnerability exists in X-Cart 5.1.10 and earlier versions. A remote attacker can exploit this vulnerability by sending a modified update or delete reque...

CVE-2015-0951

X-Cart before 5.1.11 allows remote authenticated users to read or delete address data of arbitrary accounts via a modified 1 update or 2 remove request...

CVE-2015-0950

Cross-site scripting XSS vulnerability in admin.php in X-Cart 5.1.6 through 5.1.10 allows remote attackers to inject arbitrary web script or HTML via the substring parameter...

Cross site request forgery (csrf)

X-Cart before 5.1.11 allows remote authenticated users to read or delete address data of arbitrary accounts via a modified 1 update or 2 remove request...

Cross site scripting

Cross-site scripting XSS vulnerability in admin.php in X-Cart 5.1.6 through 5.1.10 allows remote attackers to inject arbitrary web script or HTML via the substring parameter...

CVE-2015-0951

CVE-2015-0951 affects X-Cart before 5.1.11, enabling a remote, authenticated attacker to read or delete address data of other users via manipulated update/remove requests (insecure direct object reference). The issue affects 5.1.10 and earlier per CNVD/NVD/Cert notes; vendor fix is X-Cart 5.1.11....

CVE-2015-0950

Cross-site scripting XSS vulnerability in admin.php in X-Cart 5.1.6 through 5.1.10 allows remote attackers to inject arbitrary web script or HTML via the substring parameter...

CVE-2015-0951

X-Cart before 5.1.11 allows remote authenticated users to read or delete address data of arbitrary accounts via a modified 1 update or 2 remove request...