ZC
Vendor
Zen Cart
46
CVEs
0
On KEV
4
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-108829 | ZC Zen Cart Zen Cart | 4.7 | Oct 12 | Zen Cart Module Configuration modules.php sql injection |
| CVE-2026-108828 | ZC Zen Cart Zen Cart | 4.1 | Oct 12 | Zen Cart Admin Panel configuration.php eval sql injection |
| CVE-2026-108827 | ZC Zen Cart Zen Cart | 4.1 | Oct 12 | Zen Cart Administrative Module Management general.php zen_call_function code injection |
| CVE-2026-108826 | ZC Zen Cart Zen Cart | 7.3 | Oct 12 | Zen Cart PayPal IPN paypaldp.php zen_db_perform sql injection |
| CVE-2024-5762 | ZC Zen Cart Zen-cart | 8.1 | Aug 21 | Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability |
| CVE-2020-6578 | ZC Zen Cart Zen-cart | 6.1 | Mar 19 | Zen Cart 1.5.6d allows reflected XSS via the main_page parameter to includes/templates/template_default/common/tpl_main_page.php or… |
| CVE-2021-3291 | ZC Zen Cart Zen-cart | 7.2 | Jan 26 | Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command |
| CVE-2015-8352 | ZC Zen Cart Zen-cart | 9.8 | Aug 24 | Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a |
| CVE-2017-11675 | ZC Zen Cart Zen-cart | 8.8 | Jul 27 | The traverseStrictSanitize function in admin_dir/includes/classes/AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which allows remote authenticated users to… |
| CVE-2017-10667 | ZC Zen Cart Zen-cart | 6.1 | Jun 29 | In index.php in Zen Cart 1.6.0, the products_id parameter can cause XSS |
| CVE-2017-8833 | ZC Zen Cart Zen-cart | 6.1 | May 8 | Zen Cart 1.6.0 has XSS in the main_page parameter to index.php |
| CVE-2011-4403 | ZC Zen Cart Zen-cart | – | Apr 24 | Multiple cross-site request forgery (CSRF) vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that (1) delete a… |
| CVE-2015-0882 | ZC Zen Cart Zen-cart | – | Feb 27 | Multiple cross-site scripting (XSS) vulnerabilities in zencart-ja (aka Zen Cart Japanese edition) 1.3 jp through 1.3.0.2 jp8 and 1.5 ja through 1.5.1 ja allow remote attackers to… |
| CVE-2012-5808 | ZC Zen Cart Zen-cart | – | Nov 4 | The LinkPoint module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate,… |
| CVE-2012-5807 | ZC Zen Cart Zen-cart | – | Nov 4 | The Authorize.Net eCheck module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509… |
| CVE-2012-5806 | ZC Zen Cart Zen-cart | – | Nov 4 | The PayPal Payments Pro module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509… |
| CVE-2012-5805 | ZC Zen Cart Zen-cart | – | Nov 4 | The PayPal IPN functionality in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509… |
| CVE-2012-1413 | ZC Zen Cart Zen-cart | – | May 27 | Cross-site scripting (XSS) vulnerability in zc_install/includes/modules/pages/database_setup/header_php.php in Zen Cart 1.5.0 and earlier, when the software is being installed,… |
| CVE-2011-4567 | ZC Zen Cart Zen-cart | – | Nov 29 | Cross-site scripting (XSS) vulnerability in includes/templates/template_default/templates/tpl_gv_send_default.php in Zen Cart before 1.5 allows remote attackers to inject… |
| CVE-2011-4547 | ZC Zen Cart Zen-cart | – | Nov 29 | Multiple cross-site scripting (XSS) vulnerabilities in includes/templates/template_default/common/tpl_header_test_info.php in Zen Cart 1.3.9h, when debugging is enabled, might… |
| CVE-2009-4323 | ZC Zen Cart Zen-cart | – | Dec 14 | The installation for Zen Cart stores sensitive information and insecure programs under the (1) docs, (2) extras, and (3) zc_install folders, and (4) install.txt, which allows… |
| CVE-2009-4322 | ZC Zen Cart Zen-cart | – | Dec 14 | extras/ipn_test_return.php in Zen Cart allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message |
| CVE-2009-4321 | ZC Zen Cart Zen-cart | – | Dec 14 | extras/curltest.php in Zen Cart 1.3.8 and 1.3.8a, and possibly other versions, allows remote attackers to read arbitrary files via a file:// URI |
| CVE-2008-6986 | ZC Zen Cart Zen-cart | – | Aug 19 | SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shopping_cart.php in Zen Cart 1.3.0 through 1.3.8a, when magic_quotes_gpc is disabled,… |
| CVE-2008-6985 | ZC Zen Cart Zen-cart | – | Aug 19 | Multiple SQL injection vulnerabilities in includes/classes/shopping_cart.php in Zen Cart 1.2.0 through 1.3.8a, when magic_quotes_gpc is disabled, allow remote attackers to execute… |
| CVE-2008-6878 | ZC Zen Cart Zen Cart | – | Jul 27 | Directory traversal vulnerability in admin/includes/languages/english.php in Zen Cart 1.3.8a, 1.3.8, and earlier, when .htaccess is not supported, allows remote attackers to… |
| CVE-2008-6877 | ZC Zen Cart Zen Cart | – | Jul 27 | Directory traversal vulnerability in admin/includes/initsystem.php in Zen Cart 1.3.8 and 1.3.8a, when .htaccess is not supported, allows remote attackers to include and execute… |
| CVE-2009-2255 | ZC Zen Cart Zen-cart | – | Jun 30 | Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which allows remote attackers to execute arbitrary code by… |
| CVE-2009-2254 | ZC Zen Cart Zen-cart | – | Jun 30 | Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows remote attackers to execute arbitrary SQL commands via the… |
| CVE-2008-6616 | ZC Zen Cart Zen-cart | – | Apr 6 | Cross-site scripting (XSS) vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in the… |
| CVE-2008-6615 | ZC Zen Cart Zen-cart | – | Apr 6 | SQL injection vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to execute arbitrary SQL commands via the keyword parameter in the… |
| CVE-2007-3597 | ZC Zen Cart Zen Cart | – | Jul 6 | Session fixation vulnerability in Zen Cart 1.3.7 and earlier allows remote attackers to hijack web sessions by setting the Cookie parameter |
| CVE-2006-6868 | WS Web Shopping Cart Zen Cart | – | Dec 31 | Multiple cross-site scripting (XSS) vulnerabilities in Zen Cart Web Shopping Cart before 1.3.7 allow remote attackers to inject arbitrary web script or HTML via unspecified… |
| CVE-2006-5119 | ZC Zen Cart Zen Cart | – | Oct 3 | Multiple cross-site scripting (XSS) vulnerabilities in Zen Cart 1.3.5 allow remote attackers to inject arbitrary web script or HTML via the (1) admin_name or (2) admin_pass… |
| CVE-2006-4218 | ZC Zen Cart Zen Cart | – | Aug 17 | Directory traversal vulnerability in Zen Cart 1.3.0.2 and earlier allows remote attackers to include and possibly execute arbitrary local files via directory traversal sequences… |
| CVE-2006-4214 | ZC Zen Cart Zen Cart | – | Aug 17 | Multiple SQL injection vulnerabilities in Zen Cart 1.3.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via (1) GPC data to the ipn_get_stored_session… |
| CVE-2006-4215 | ZC Zen Cart Zen Cart | – | Aug 17 | PHP remote file inclusion vulnerability in index.php in Zen Cart 1.3.0.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a… |
| CVE-2006-3757 | ZC Zen Cart Zen Cart | – | Jul 21 | index.php in Zen Cart 1.3.0.2 allows remote attackers to obtain sensitive information via empty (1) _GET[], (2) _SESSION[], (3) _POST[], (4) _COOKIE[], or (5) _SESSION[] array… |
| CVE-2006-0697 | ZC Zen Cart Zen-cart | – | Feb 15 | Zen Cart before 1.2.7 does not protect the admin/includes directory, which allows remote attackers to cause unknown impact via unspecified vectors, probably direct requests |
| CVE-2006-0698 | ZC Zen Cart Zen Cart | – | Feb 15 | Unspecified vulnerabilities in Zen Cart before 1.2.7 allow remote attackers to cause unknown impact via unspecified vectors related to "other attempted exploits" other than SQL… |
| CVE-2006-0696 | ZC Zen Cart Zen Cart | – | Feb 15 | SQL injection vulnerability in Zen Cart before 1.2.7 allows remote attackers to execute arbitrary SQL commands via unspecified vectors |
| CVE-2005-3997 | ZC Zen Cart Zen Cart | – | Dec 5 | Zen Cart 1.2.6d and earlier, under certain PHP configurations, allows remote attackers to obtain sensitive information via direct requests to files in the admin/includes… |
| CVE-2005-3996 | ZC Zen Cart Zen-cart | – | Dec 5 | SQL injection vulnerability in admin/password_forgotten.php in Zen Cart 1.2.6d and earlier allows remote attackers to execute arbitrary SQL commands via the admin_email parameter |
| CVE-2004-2024 | ZC Zen Cart Zen Cart | – | Dec 31 | The distribution of Zen Cart 1.1.4 before patch 2 includes certain debugging code in the Admin password retrieval functionality, which allows attackers to gain administrative… |
| CVE-2004-2025 | ZC Zen Cart Zen Cart | – | Dec 31 | SQL injection vulnerability in application_top.php for Zen Cart 1.1.3 before patch 2 may allow remote attackers to execute arbitrary SQL commands via the products_id parameter |
| CVE-2004-2023 | ZC Zen Cart Zen Cart | – | Dec 31 | SQL injection vulnerability in login.php in Zen Cart 1.1.2d, 1.1.4 before patch 1, and possibly other versions allows remote attackers to execute arbitrary SQL via the (1)… |