ZC
Product
Zen Cart
45
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 1High 4Medium 6Low 0
Watch
Add Zen Cart to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-8352 | 9.8 | Aug 24 | Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a Affected: 1.5.4 |
| CVE-2017-11675 | 8.8 | Jul 27 | The traverseStrictSanitize function in admin_dir/includes/classes/AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which allows remote authenticated users to… Affected: 1.5.5e |
| CVE-2024-5762 | 8.1 | Aug 21 | Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability Affected: 1.5.8a |
| CVE-2026-108826 | 7.3 | Oct 12 | Zen Cart PayPal IPN paypaldp.php zen_db_perform sql injection Affected: 2.2.0; 2.2.1; 2.2.2 |
| CVE-2021-3291 | 7.2 | Jan 26 | Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command Affected: 1.5.7b |
| CVE-2020-6578 | 6.1 | Mar 19 | Zen Cart 1.5.6d allows reflected XSS via the main_page parameter to includes/templates/template_default/common/tpl_main_page.php or… Affected: 1.5.6d |
| CVE-2017-10667 | 6.1 | Jun 29 | In index.php in Zen Cart 1.6.0, the products_id parameter can cause XSS Affected: 1.6.0 |
| CVE-2017-8833 | 6.1 | May 8 | Zen Cart 1.6.0 has XSS in the main_page parameter to index.php Affected: 1.6.0 |
| CVE-2026-108829 | 4.7 | Oct 12 | Zen Cart Module Configuration modules.php sql injection Affected: 2.2.0; 2.2.1; 2.2.2 |
| CVE-2026-108828 | 4.1 | Oct 12 | Zen Cart Admin Panel configuration.php eval sql injection Affected: 2.2.2 |
| CVE-2026-108827 | 4.1 | Oct 12 | Zen Cart Administrative Module Management general.php zen_call_function code injection Affected: 2.2.0; 2.2.1; 2.2.2 |
| CVE-2011-4403 | – | Apr 24 | Multiple cross-site request forgery (CSRF) vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that (1) delete a… Affected: 1.3.9h |
| CVE-2015-0882 | – | Feb 27 | Multiple cross-site scripting (XSS) vulnerabilities in zencart-ja (aka Zen Cart Japanese edition) 1.3 jp through 1.3.0.2 jp8 and 1.5 ja through 1.5.1 ja allow remote attackers to… Affected: 1.3.0.0; 1.3.0.1; 1.3.0.2; 1.5.0; 1.5.1 |
| CVE-2012-5808 | – | Nov 4 | The LinkPoint module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate,… Affected: All versions, or not specified |
| CVE-2012-5807 | – | Nov 4 | The Authorize.Net eCheck module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509… Affected: All versions, or not specified |
| CVE-2012-5806 | – | Nov 4 | The PayPal Payments Pro module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509… Affected: All versions, or not specified |
| CVE-2012-5805 | – | Nov 4 | The PayPal IPN functionality in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509… Affected: All versions, or not specified |
| CVE-2012-1413 | – | May 27 | Cross-site scripting (XSS) vulnerability in zc_install/includes/modules/pages/database_setup/header_php.php in Zen Cart 1.5.0 and earlier, when the software is being installed,… Affected: through 1.5; 1.1.0; 1.1.3; 1.2.0d; 1.2.1; 1.2.1_patch1; +18 more |
| CVE-2011-4567 | – | Nov 29 | Cross-site scripting (XSS) vulnerability in includes/templates/template_default/templates/tpl_gv_send_default.php in Zen Cart before 1.5 allows remote attackers to inject… Affected: through 1.3.9; 1.1.0; 1.1.3; 1.2.0d; 1.2.1; 1.2.1d; +14 more |
| CVE-2011-4547 | – | Nov 29 | Multiple cross-site scripting (XSS) vulnerabilities in includes/templates/template_default/common/tpl_header_test_info.php in Zen Cart 1.3.9h, when debugging is enabled, might… Affected: 1.3.9h |
| CVE-2009-4323 | – | Dec 14 | The installation for Zen Cart stores sensitive information and insecure programs under the (1) docs, (2) extras, and (3) zc_install folders, and (4) install.txt, which allows… Affected: All versions, or not specified |
| CVE-2009-4322 | – | Dec 14 | extras/ipn_test_return.php in Zen Cart allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message Affected: All versions, or not specified |
| CVE-2009-4321 | – | Dec 14 | extras/curltest.php in Zen Cart 1.3.8 and 1.3.8a, and possibly other versions, allows remote attackers to read arbitrary files via a file:// URI Affected: 1.3.8; 1.3.8a |
| CVE-2008-6986 | – | Aug 19 | SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shopping_cart.php in Zen Cart 1.3.0 through 1.3.8a, when magic_quotes_gpc is disabled,… Affected: 1.3; 1.3.0.2; 1.3.2; 1.3.5; 1.3.6; 1.3.7; +2 more |
| CVE-2008-6985 | – | Aug 19 | Multiple SQL injection vulnerabilities in includes/classes/shopping_cart.php in Zen Cart 1.2.0 through 1.3.8a, when magic_quotes_gpc is disabled, allow remote attackers to execute… Affected: 1.2.0d; 1.2.1_patch1; 1.2.1d; 1.2.2d; 1.2.3d; 1.2.4.1; +10 more |
| CVE-2008-6878 | – | Jul 27 | Directory traversal vulnerability in admin/includes/languages/english.php in Zen Cart 1.3.8a, 1.3.8, and earlier, when .htaccess is not supported, allows remote attackers to… Affected: 1.3.8; 1.3.8a |
| CVE-2008-6877 | – | Jul 27 | Directory traversal vulnerability in admin/includes/initsystem.php in Zen Cart 1.3.8 and 1.3.8a, when .htaccess is not supported, allows remote attackers to include and execute… Affected: 1.3.8; 1.3.8a |
| CVE-2009-2255 | – | Jun 30 | Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which allows remote attackers to execute arbitrary code by… Affected: through 1.3.8a; 1.1.0; 1.1.3; 1.2.0d; 1.2.1d; 1.2.4d; +3 more |
| CVE-2009-2254 | – | Jun 30 | Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows remote attackers to execute arbitrary SQL commands via the… Affected: through 1.3.8a; 1.1.0; 1.1.3; 1.2.0d; 1.2.1d; 1.2.4d; +3 more |
| CVE-2008-6616 | – | Apr 6 | Cross-site scripting (XSS) vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in the… Affected: 2008 |
| CVE-2008-6615 | – | Apr 6 | SQL injection vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to execute arbitrary SQL commands via the keyword parameter in the… Affected: 2008 |
| CVE-2007-3597 | – | Jul 6 | Session fixation vulnerability in Zen Cart 1.3.7 and earlier allows remote attackers to hijack web sessions by setting the Cookie parameter Affected: through 1.3.7 |
| CVE-2006-5119 | – | Oct 3 | Multiple cross-site scripting (XSS) vulnerabilities in Zen Cart 1.3.5 allow remote attackers to inject arbitrary web script or HTML via the (1) admin_name or (2) admin_pass… Affected: 1.3.5 |
| CVE-2006-4218 | – | Aug 17 | Directory traversal vulnerability in Zen Cart 1.3.0.2 and earlier allows remote attackers to include and possibly execute arbitrary local files via directory traversal sequences… Affected: 1.2.0d; 1.2.1_patch1; 1.2.1d; 1.2.2d; 1.2.3d; 1.2.4.1; +4 more |
| CVE-2006-4214 | – | Aug 17 | Multiple SQL injection vulnerabilities in Zen Cart 1.3.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via (1) GPC data to the ipn_get_stored_session… Affected: through 1.3.0.2 |
| CVE-2006-4215 | – | Aug 17 | PHP remote file inclusion vulnerability in index.php in Zen Cart 1.3.0.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a… Affected: through 1.3.0.2 |
| CVE-2006-3757 | – | Jul 21 | index.php in Zen Cart 1.3.0.2 allows remote attackers to obtain sensitive information via empty (1) _GET[], (2) _SESSION[], (3) _POST[], (4) _COOKIE[], or (5) _SESSION[] array… Affected: 1.3.0.2 |
| CVE-2006-0697 | – | Feb 15 | Zen Cart before 1.2.7 does not protect the admin/includes directory, which allows remote attackers to cause unknown impact via unspecified vectors, probably direct requests Affected: through 1.2.6d; 1.1.0; 1.1.3; 1.2.0d; 1.2.1; 1.2.1d; +5 more |
| CVE-2006-0698 | – | Feb 15 | Unspecified vulnerabilities in Zen Cart before 1.2.7 allow remote attackers to cause unknown impact via unspecified vectors related to "other attempted exploits" other than SQL… Affected: 1.1.0; 1.1.1d; 1.1.2d; 1.1.3d; 1.1.4d; 1.2.0d; +8 more |
| CVE-2006-0696 | – | Feb 15 | SQL injection vulnerability in Zen Cart before 1.2.7 allows remote attackers to execute arbitrary SQL commands via unspecified vectors Affected: 1.1.0; 1.1.1d; 1.1.2d; 1.1.3d; 1.1.4d; 1.2.0d; +8 more |
| CVE-2005-3997 | – | Dec 5 | Zen Cart 1.2.6d and earlier, under certain PHP configurations, allows remote attackers to obtain sensitive information via direct requests to files in the admin/includes… Affected: through 1.2.6d |
| CVE-2005-3996 | – | Dec 5 | SQL injection vulnerability in admin/password_forgotten.php in Zen Cart 1.2.6d and earlier allows remote attackers to execute arbitrary SQL commands via the admin_email parameter Affected: through 1.2.6d |
| CVE-2004-2024 | – | Dec 31 | The distribution of Zen Cart 1.1.4 before patch 2 includes certain debugging code in the Admin password retrieval functionality, which allows attackers to gain administrative… Affected: 1.1.4 |
| CVE-2004-2025 | – | Dec 31 | SQL injection vulnerability in application_top.php for Zen Cart 1.1.3 before patch 2 may allow remote attackers to execute arbitrary SQL commands via the products_id parameter Affected: 1.1.3 |
| CVE-2004-2023 | – | Dec 31 | SQL injection vulnerability in login.php in Zen Cart 1.1.2d, 1.1.4 before patch 1, and possibly other versions allows remote attackers to execute arbitrary SQL via the (1)… Affected: 1.1.2d; 1.1.4 |
Showing 45