CVE-2007-4907: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in X-Cart allow remote attackers to execute arbitrary PHP code via a URL in the xcartdir parameter to 1 config.php, 2 prepare.php, 3 smarty.php, 4 customer/product.php, 5 provider/auth.php, and 6 admin/auth.php...

CVE-2006-4904: Undefined Security Weakness

Dynamic variable evaluation vulnerability in cmpi.php in Qualiteam X-Cart 4.1.3 and earlier allows remote attackers to overwrite arbitrary program variables and execute arbitrary PHP code, as demonstrated by PHP remote file inclusion via the xcartdir parameter...