Filtered by vendor Zen-cart Subscriptions
Filtered by product Zen Cart Subscriptions
Total 26 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2008-6616 1 Zen-cart 1 Zen Cart 2017-08-17 N/A
Cross-site scripting (XSS) vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in the advanced_search_result page. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2008-6615 1 Zen-cart 1 Zen Cart 2017-08-17 N/A
SQL injection vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to execute arbitrary SQL commands via the keyword parameter in the advanced_search_result page. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2017-11675 1 Zen-cart 1 Zen Cart 2017-08-04 N/A
The traverseStrictSanitize function in admin_dir/includes/classes/AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which allows remote authenticated users to execute arbitrary PHP code by placing that code into an invalid array index of the admin_name array parameter to admin_dir/login.php, if there is an export of an error-log entry for that invalid array index.
CVE-2017-8833 1 Zen-cart 1 Zen Cart 2017-05-30 N/A
Zen Cart 1.6.0 has XSS in the main_page parameter to index.php. NOTE: 1.6.0 is not an official release but the vendor's README.md file offers a link to v160.zip with a description of "Download latest in-development version from github."
CVE-2011-4403 1 Zen-cart 1 Zen Cart 2015-04-27 N/A
Multiple cross-site request forgery (CSRF) vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that (1) delete a product via a delete_product_confirm action to product.php or (2) disable a product via a setflag action to categories.php.
CVE-2006-0697 1 Zen-cart 1 Zen Cart 2013-01-03 N/A
Zen Cart before 1.2.7 does not protect the admin/includes directory, which allows remote attackers to cause unknown impact via unspecified vectors, probably direct requests.