CVE-2015-0950

X-Cart 5.1.6–5.1.10 contains a reflected XSS in admin.php via the substring parameter, allowing remote script injection in the user’s browser. Root cause: improper handling of input leading to script execution. Impact: remote attacker could run arbitrary script in the context of victims’ sessions...