CVE-2004-2411

The CleanseMessage function in shop$db.asp for VP-ASP Shopping Cart 4.0 through 5.0 does not sufficiently cleanse inputs, which allows remote attackers to conduct cross-site scripting XSS attacks that do not use tags, as demonstrated via javascript in IMG tags to 1 the cat parameter in...