Cpcommerce » Cpcommerce » 1.0.7.3 : Security Vulnerabilities, CVEs,
Cross-site scripting (XSS) vulnerability in cpCommerce before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via unknown vectors in the advanced search feature. NOTE: this is probably a variant of CVE-2008-4121.
Max CVSS
4.3
EPSS Score
0.13%
Published
2008-10-21
Updated
2017-08-08
Multiple cross-site scripting (XSS) vulnerabilities in cpCommerce before 1.2.4 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in a search.quick action to search.php and (2) the name parameter in a sendtofriend action to sendtofriend.php.
Max CVSS
4.3
EPSS Score
0.41%
Published
2008-10-21
Updated
2018-10-11
Cross-site scripting (XSS) vulnerability in register.php in cpCommerce 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the name parameter (Full Name field).
Max CVSS
4.3
EPSS Score
0.64%
Published
2007-06-01
Updated
2018-10-16
SQL injection vulnerability in manufacturer.php in cpCommerce before 1.1.0 allows remote attackers to execute arbitrary SQL commands via the id_manufacturer parameter.
Max CVSS
7.5
EPSS Score
0.63%
Published
2007-05-31
Updated
2018-10-16
SQL injection vulnerability in category.php in cpCommerce 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id_category parameter.
Max CVSS
7.5
EPSS Score
0.82%
Published
2007-05-30
Updated
2017-10-11
5 vulnerabilities found