Zen Cart 1.5.6d allows reflected XSS via the main_page parameter to includes/templates/template_default/common/tpl_main_page.php or includes/templates/responsive_classic/common/tpl_main_page.php.
Max CVSS
6.1
EPSS Score
0.08%
Published
2021-03-19
Updated
2021-03-25
In index.php in Zen Cart 1.6.0, the products_id parameter can cause XSS.
Max CVSS
6.1
EPSS Score
0.06%
Published
2017-06-29
Updated
2017-07-03
Zen Cart 1.6.0 has XSS in the main_page parameter to index.php. NOTE: 1.6.0 is not an official release but the vendor's README.md file offers a link to v160.zip with a description of "Download latest in-development version from github."
Max CVSS
6.1
EPSS Score
0.09%
Published
2017-05-08
Updated
2017-05-30
Multiple cross-site scripting (XSS) vulnerabilities in zencart-ja (aka Zen Cart Japanese edition) 1.3 jp through 1.3.0.2 jp8 and 1.5 ja through 1.5.1 ja allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to admin/includes/init_includes/init_sanitize.php and includes/init_includes/init_sanitize.php.
Max CVSS
4.3
EPSS Score
0.14%
Published
2015-02-27
Updated
2017-12-07
Cross-site scripting (XSS) vulnerability in zc_install/includes/modules/pages/database_setup/header_php.php in Zen Cart 1.5.0 and earlier, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the db_username parameter to zc_install/index.php.
Max CVSS
2.6
EPSS Score
0.10%
Published
2012-05-27
Updated
2012-05-28
Cross-site scripting (XSS) vulnerability in includes/templates/template_default/templates/tpl_gv_send_default.php in Zen Cart before 1.5 allows remote attackers to inject arbitrary web script or HTML via the message parameter in a gv_send action to index.php, a different vulnerability than CVE-2011-4547.
Max CVSS
4.3
EPSS Score
0.20%
Published
2011-11-29
Updated
2017-08-29
Multiple cross-site scripting (XSS) vulnerabilities in includes/templates/template_default/common/tpl_header_test_info.php in Zen Cart 1.3.9h, when debugging is enabled, might allow remote attackers to inject arbitrary web script or HTML via the (1) main_page parameter or (2) PATH_INFO, a different vulnerability than CVE-2011-4567.
Max CVSS
4.3
EPSS Score
0.20%
Published
2011-11-29
Updated
2017-08-29
Cross-site scripting (XSS) vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in the advanced_search_result page. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Max CVSS
4.3
EPSS Score
0.20%
Published
2009-04-06
Updated
2017-08-17
8 vulnerabilities found