CVE-2012-1413

Cross-site scripting XSS vulnerability in zcinstall/includes/modules/pages/databasesetup/headerphp.php in Zen Cart 1.5.0 and earlier, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the dbusername parameter to zcinstall/index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in zcinstall/includes/modules/pages/databasesetup/headerphp.php in Zen Cart 1.5.0 and earlier, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the dbusername parameter to zcinstall/index.php...

CVE-2012-1413

Cross-site scripting XSS vulnerability in zcinstall/includes/modules/pages/databasesetup/headerphp.php in Zen Cart 1.5.0 and earlier, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the dbusername parameter to zcinstall/index.php...

CVE-2012-1413

Zen Cart CVE-2012-1413 affects Zen Cart 1.5.0 and earlier during installation. The XSS flaw resides in zc_install/includes/modules/pages/database_setup/header_php.php, exploitable via the db_username parameter to zc_install/index.php, allowing remote script/HTML injection. No exploit details or m...

SA-CONTRIB-2012-082 - Zen - Cross Site Scripting

CVE: CVE-2012-2710. The Zen theme provides a configurable breadcrumb which is commonly used as an additional navigation tool for users. The theme outputs the breadcrumb, but does not provide sufficient filtering to prevent a Cross site scripting XSS attack. This vulnerability is mitigated by the...

Zen Cart 1.3.8a File Upload

File upload vulnerability in Zen Cart Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

Zen Cart 1.3.9f LFI

Local file include vulnerability in Zen Cart typefilter parameter Vulnerability Type: Local File Include For the exploit source code contact DSquare Security sales team...

Zen Cart v.1.5.0 Remote Shell Upload

Exploit for php platform in category web applications Remote Shell Upload Vulnerability DaTe : 5.3.2012 Version : 1.5.0 Tested on: Linux " Ubuntu " , "win 7" Author : Mr.ExiT OrPh4n Email : email protected Site : sh4ck.com + v99x.com Dork : "Powered by Zen Cart" Software Link:...

Zen Cart 'path_to_admin/product.php'跨站请求伪造漏洞

Bugtraq ID: 51968 CVE ID：CVE-2011-4403 Zen Cart是一款免费的购物车软件。 Zen Cart管理控制面板存在跨站请求伪造漏洞，攻击者提交特制表单，可以管理员权限删除或禁用产品等。 0 Zen Cart 1.3.9h 厂商解决方案 目前没有详细解决方案提供： http://www.zen-cart.com/ form name="products" action=" http://www.mysite.com/pathtoadmin/product.php?action=deleteproductconfirm"; method="post"...

Zen-Cart 1.3.9h Cross Site Request Forgery

Advisory Information Title: Zen-Cart Admin CSRF/XSRF - Delete / Disable Products Date published: 2012-02-10 01:59:45 AM upSploit Ref: UPS-2011-0018 CVE REF: CVE-2011-4403 Advisory Summary An attacker can force an administrator to delete or disable products from within his store. Vendor Zen-Cart...

Zen Cart 1.3.9h - '/path_to_admin/product.php' Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/51968/info Zen Cart is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also...

Zen Cart 1.3.9h - path_to_adminproduct.php Cross-Site Request Forgery

Zen Cart 1.3.9h - pathtoadminproduct.php Cross-Site Request Forgery source: https://www.securityfocus.com/bid/51968/info Zen Cart is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthoriz...

CVE-2011-4547

Multiple cross-site scripting XSS vulnerabilities in includes/templates/templatedefault/common/tplheadertestinfo.php in Zen Cart 1.3.9h, when debugging is enabled, might allow remote attackers to inject arbitrary web script or HTML via the 1 mainpage parameter or 2 PATHINFO, a different...

CVE-2011-4567

Cross-site scripting XSS vulnerability in includes/templates/templatedefault/templates/tplgvsenddefault.php in Zen Cart before 1.5 allows remote attackers to inject arbitrary web script or HTML via the message parameter in a gvsend action to index.php, a different vulnerability than CVE-2011-4547...

Cross site scripting

Cross-site scripting XSS vulnerability in includes/templates/templatedefault/templates/tplgvsenddefault.php in Zen Cart before 1.5 allows remote attackers to inject arbitrary web script or HTML via the message parameter in a gvsend action to index.php, a different vulnerability than CVE-2011-4547...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in includes/templates/templatedefault/common/tplheadertestinfo.php in Zen Cart 1.3.9h, when debugging is enabled, might allow remote attackers to inject arbitrary web script or HTML via the 1 mainpage parameter or 2 PATHINFO, a different...

CVE-2011-4547

Multiple cross-site scripting XSS vulnerabilities in includes/templates/templatedefault/common/tplheadertestinfo.php in Zen Cart 1.3.9h, when debugging is enabled, might allow remote attackers to inject arbitrary web script or HTML via the 1 mainpage parameter or 2 PATHINFO, a different...

CVE-2011-4567

Cross-site scripting XSS vulnerability in includes/templates/templatedefault/templates/tplgvsenddefault.php in Zen Cart before 1.5 allows remote attackers to inject arbitrary web script or HTML via the message parameter in a gvsend action to index.php, a different vulnerability than CVE-2011-4547...

CVE-2011-4547

CVE-2011-4547 covers multiple cross-site scripting (XSS) vulnerabilities in Ze n Cart 1.3.9h. The issues affect includes/templates/template_default/common/tpl_header_test_info.php when debugging is enabled, enabling an attacker to inject arbitrary script/HTML via the (1) main_page parameter or (2...

CVE-2011-4567

The CVE-2011-4567 entry details a Cross‑site Scripting (XSS) vulnerability in Zen Cart, specifically in includes/templates/template_default/templates/tpl_gv_send_default.php, exploitable by injecting arbitrary script/HTML through the message parameter in a gv_send action to index.php. Affected ve...