[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7XqZVa3gYWp5j-mxu2zSSVHW8vKR4e8Pi7OfP4wI698":3,"g5a-ex:zen-cart\u002Fzen_cart@*":252,"g5a-family:zen-cart\u002Fzen_cart":254},{"success":4,"data":5},true,{"product":6,"versions":119,"topVulnerabilitiesByEpss":168,"kevVulnerabilities":229,"seoMetadata":230,"meta":249},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":118},"zen-cart","zen_cart",48,27,0,"2024-08-21",[14,18,20,23,26,28,31,34,36,38,40,42,44,46,49,51,53,55,57,59,61,64,66,68,70,72,74,76,78,80,82,84,86,88,90,92,94,96,98,100,102,104,106,108,110,112,114,116],{"version":15,"cve_count":16,"kev_count":11,"has_kev":17},"1.1.0",5,false,{"version":19,"cve_count":16,"kev_count":11,"has_kev":17},"1.1.3",{"version":21,"cve_count":22,"kev_count":11,"has_kev":17},"1.2.0d",6,{"version":24,"cve_count":25,"kev_count":11,"has_kev":17},"1.2.1",3,{"version":27,"cve_count":22,"kev_count":11,"has_kev":17},"1.2.1d",{"version":29,"cve_count":30,"kev_count":11,"has_kev":17},"1.2.1_patch1",2,{"version":32,"cve_count":33,"kev_count":11,"has_kev":17},"1.2.2d",4,{"version":35,"cve_count":33,"kev_count":11,"has_kev":17},"1.2.3d",{"version":37,"cve_count":33,"kev_count":11,"has_kev":17},"1.2.4.1",{"version":39,"cve_count":22,"kev_count":11,"has_kev":17},"1.2.4d",{"version":41,"cve_count":33,"kev_count":11,"has_kev":17},"1.2.5d",{"version":43,"cve_count":25,"kev_count":11,"has_kev":17},"1.2.6d",{"version":45,"cve_count":33,"kev_count":11,"has_kev":17},"1.3",{"version":47,"cve_count":48,"kev_count":11,"has_kev":17},"1.3.0.0",1,{"version":50,"cve_count":48,"kev_count":11,"has_kev":17},"1.3.0.1",{"version":52,"cve_count":33,"kev_count":11,"has_kev":17},"1.3.0.2",{"version":54,"cve_count":33,"kev_count":11,"has_kev":17},"1.3.2",{"version":56,"cve_count":33,"kev_count":11,"has_kev":17},"1.3.5",{"version":58,"cve_count":22,"kev_count":11,"has_kev":17},"1.3.6",{"version":60,"cve_count":22,"kev_count":11,"has_kev":17},"1.3.7",{"version":62,"cve_count":63,"kev_count":11,"has_kev":17},"1.3.8",7,{"version":65,"cve_count":16,"kev_count":11,"has_kev":17},"1.3.8a",{"version":67,"cve_count":48,"kev_count":11,"has_kev":17},"1.3.9",{"version":69,"cve_count":25,"kev_count":11,"has_kev":17},"1.3.9h",{"version":71,"cve_count":11,"kev_count":11,"has_kev":17},"1.5",{"version":73,"cve_count":48,"kev_count":11,"has_kev":17},"1.5.0",{"version":75,"cve_count":48,"kev_count":11,"has_kev":17},"1.5.1",{"version":77,"cve_count":11,"kev_count":11,"has_kev":17},"1.5.2",{"version":79,"cve_count":11,"kev_count":11,"has_kev":17},"1.5.3",{"version":81,"cve_count":48,"kev_count":11,"has_kev":17},"1.5.4",{"version":83,"cve_count":11,"kev_count":11,"has_kev":17},"1.5.5",{"version":85,"cve_count":11,"kev_count":11,"has_kev":17},"1.5.5a",{"version":87,"cve_count":11,"kev_count":11,"has_kev":17},"1.5.5b",{"version":89,"cve_count":11,"kev_count":11,"has_kev":17},"1.5.5c",{"version":91,"cve_count":11,"kev_count":11,"has_kev":17},"1.5.5d",{"version":93,"cve_count":48,"kev_count":11,"has_kev":17},"1.5.5e",{"version":95,"cve_count":11,"kev_count":11,"has_kev":17},"1.5.5f",{"version":97,"cve_count":11,"kev_count":11,"has_kev":17},"1.5.6",{"version":99,"cve_count":11,"kev_count":11,"has_kev":17},"1.5.6a",{"version":101,"cve_count":11,"kev_count":11,"has_kev":17},"1.5.6b",{"version":103,"cve_count":11,"kev_count":11,"has_kev":17},"1.5.6c",{"version":105,"cve_count":48,"kev_count":11,"has_kev":17},"1.5.6d",{"version":107,"cve_count":11,"kev_count":11,"has_kev":17},"1.5.7",{"version":109,"cve_count":11,"kev_count":11,"has_kev":17},"1.5.7a",{"version":111,"cve_count":48,"kev_count":11,"has_kev":17},"1.5.7b",{"version":113,"cve_count":48,"kev_count":11,"has_kev":17},"1.5.8a",{"version":115,"cve_count":30,"kev_count":11,"has_kev":17},"1.6.0",{"version":117,"cve_count":25,"kev_count":11,"has_kev":17},"2008","Zen Cart by Zen-cart is a technology product with 48 tracked versions and 27 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167],{"version":15,"cve_count":16,"kev_count":11,"has_kev":17},{"version":19,"cve_count":16,"kev_count":11,"has_kev":17},{"version":21,"cve_count":22,"kev_count":11,"has_kev":17},{"version":24,"cve_count":25,"kev_count":11,"has_kev":17},{"version":27,"cve_count":22,"kev_count":11,"has_kev":17},{"version":29,"cve_count":30,"kev_count":11,"has_kev":17},{"version":32,"cve_count":33,"kev_count":11,"has_kev":17},{"version":35,"cve_count":33,"kev_count":11,"has_kev":17},{"version":37,"cve_count":33,"kev_count":11,"has_kev":17},{"version":39,"cve_count":22,"kev_count":11,"has_kev":17},{"version":41,"cve_count":33,"kev_count":11,"has_kev":17},{"version":43,"cve_count":25,"kev_count":11,"has_kev":17},{"version":45,"cve_count":33,"kev_count":11,"has_kev":17},{"version":47,"cve_count":48,"kev_count":11,"has_kev":17},{"version":50,"cve_count":48,"kev_count":11,"has_kev":17},{"version":52,"cve_count":33,"kev_count":11,"has_kev":17},{"version":54,"cve_count":33,"kev_count":11,"has_kev":17},{"version":56,"cve_count":33,"kev_count":11,"has_kev":17},{"version":58,"cve_count":22,"kev_count":11,"has_kev":17},{"version":60,"cve_count":22,"kev_count":11,"has_kev":17},{"version":62,"cve_count":63,"kev_count":11,"has_kev":17},{"version":65,"cve_count":16,"kev_count":11,"has_kev":17},{"version":67,"cve_count":48,"kev_count":11,"has_kev":17},{"version":69,"cve_count":25,"kev_count":11,"has_kev":17},{"version":71,"cve_count":11,"kev_count":11,"has_kev":17},{"version":73,"cve_count":48,"kev_count":11,"has_kev":17},{"version":75,"cve_count":48,"kev_count":11,"has_kev":17},{"version":77,"cve_count":11,"kev_count":11,"has_kev":17},{"version":79,"cve_count":11,"kev_count":11,"has_kev":17},{"version":81,"cve_count":48,"kev_count":11,"has_kev":17},{"version":83,"cve_count":11,"kev_count":11,"has_kev":17},{"version":85,"cve_count":11,"kev_count":11,"has_kev":17},{"version":87,"cve_count":11,"kev_count":11,"has_kev":17},{"version":89,"cve_count":11,"kev_count":11,"has_kev":17},{"version":91,"cve_count":11,"kev_count":11,"has_kev":17},{"version":93,"cve_count":48,"kev_count":11,"has_kev":17},{"version":95,"cve_count":11,"kev_count":11,"has_kev":17},{"version":97,"cve_count":11,"kev_count":11,"has_kev":17},{"version":99,"cve_count":11,"kev_count":11,"has_kev":17},{"version":101,"cve_count":11,"kev_count":11,"has_kev":17},{"version":103,"cve_count":11,"kev_count":11,"has_kev":17},{"version":105,"cve_count":48,"kev_count":11,"has_kev":17},{"version":107,"cve_count":11,"kev_count":11,"has_kev":17},{"version":109,"cve_count":11,"kev_count":11,"has_kev":17},{"version":111,"cve_count":48,"kev_count":11,"has_kev":17},{"version":113,"cve_count":48,"kev_count":11,"has_kev":17},{"version":115,"cve_count":30,"kev_count":11,"has_kev":17},{"version":117,"cve_count":25,"kev_count":11,"has_kev":17},[169,176,184,190,198,203,209,215,220,225],{"cveId":170,"description":171,"publishedDate":12,"cvssScore":172,"cvssVersion":173,"severity":174,"isKev":17,"epssScore":175},"CVE-2024-5762","Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Zen Cart. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the findPluginAdminPage function. The issue results from the lack of proper validation of user-supplied data prior to passing it to a PHP include function. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the service account. Was ZDI-CAN-21408.",8.1,"v3.1","High",0.71598,{"cveId":177,"description":178,"publishedDate":179,"cvssScore":180,"cvssVersion":181,"severity":182,"isKev":17,"epssScore":183},"CVE-2009-2255","Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin\u002Frecord_company.php, which allows remote attackers to execute arbitrary code by uploading a .php file via the record_company_image parameter in conjunction with a PATH_INFO of password_forgotten.php, then accessing this file via a direct request to the file in images\u002F.","2009-06-30",6.8,"v2","Medium",0.30966,{"cveId":185,"description":186,"publishedDate":187,"cvssScore":188,"cvssVersion":173,"severity":174,"isKev":17,"epssScore":189},"CVE-2021-3291","Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.","2021-01-26",7.2,0.16782,{"cveId":191,"description":192,"publishedDate":193,"cvssScore":194,"cvssVersion":195,"severity":196,"isKev":17,"epssScore":197},"CVE-2015-8352","Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act parameter to ajax.php.","2017-08-24",9.8,"v3.0","Critical",0.15641,{"cveId":199,"description":200,"publishedDate":179,"cvssScore":201,"cvssVersion":181,"severity":174,"isKev":17,"epssScore":202},"CVE-2009-2254","Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin\u002Fsqlpatch.php, which allows remote attackers to execute arbitrary SQL commands via the query_string parameter in an execute action, in conjunction with a PATH_INFO of password_forgotten.php, related to a \"SQL Execution\" issue.",7.5,0.1089,{"cveId":204,"description":205,"publishedDate":206,"cvssScore":207,"cvssVersion":181,"severity":196,"isKev":17,"epssScore":208},"CVE-2006-0697","Zen Cart before 1.2.7 does not protect the admin\u002Fincludes directory, which allows remote attackers to cause unknown impact via unspecified vectors, probably direct requests.","2006-02-15",10,0.05223,{"cveId":210,"description":211,"publishedDate":212,"cvssScore":213,"cvssVersion":195,"severity":174,"isKev":17,"epssScore":214},"CVE-2017-11675","The traverseStrictSanitize function in admin_dir\u002Fincludes\u002Fclasses\u002FAdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which allows remote authenticated users to execute arbitrary PHP code by placing that code into an invalid array index of the admin_name array parameter to admin_dir\u002Flogin.php, if there is an export of an error-log entry for that invalid array index.","2017-07-27",8.8,0.02896,{"cveId":216,"description":217,"publishedDate":218,"cvssScore":180,"cvssVersion":181,"severity":182,"isKev":17,"epssScore":219},"CVE-2008-6986","SQL injection vulnerability in the actionMultipleAddProduct function in includes\u002Fclasses\u002Fshopping_cart.php in Zen Cart 1.3.0 through 1.3.8a, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the products_id array parameter in a multiple_products_add_product action, a different vulnerability than CVE-2008-6985.","2009-08-19",0.02808,{"cveId":221,"description":222,"publishedDate":223,"cvssScore":201,"cvssVersion":181,"severity":174,"isKev":17,"epssScore":224},"CVE-2009-4323","The installation for Zen Cart stores sensitive information and insecure programs under the (1) docs, (2) extras, and (3) zc_install folders, and (4) install.txt, which allows remote attackers to obtain sensitive information, delete the database, and conduct other attacks via a direct request, different vulnerabilities than CVE-2009-4321 and CVE-2009-4322.","2009-12-14",0.02579,{"cveId":226,"description":227,"publishedDate":223,"cvssScore":16,"cvssVersion":181,"severity":182,"isKev":17,"epssScore":228},"CVE-2009-4321","extras\u002Fcurltest.php in Zen Cart 1.3.8 and 1.3.8a, and possibly other versions, allows remote attackers to read arbitrary files via a file:\u002F\u002F URI.  NOTE: some of these details are obtained from third party information.",0.0249,[],{"title":231,"metaDescription":232,"keywords":233,"structuredData":234},"Zen Cart by Zen-cart - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Zen Cart by Zen-cart covering 48 versions with 27 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Zen Cart vulnerabilities, Zen Cart security, Zen Cart CVE, Zen-cart Zen Cart, Zen Cart threat intelligence, Zen-cart security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":235,"@type":236,"name":237,"description":232,"url":238,"manufacturer":239,"applicationCategory":243,"softwareVersion":244,"mainEntity":245},"https:\u002F\u002Fschema.org","SoftwareApplication","Zen Cart","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fzen-cart\u002Fzen_cart",{"@type":240,"name":241,"url":242},"Organization","Zen-cart","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fzen-cart","Security Software","48 versions tracked",{"@type":246,"name":247,"description":248,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Zen Cart Security Vulnerabilities","Security vulnerabilities affecting Zen Cart by Zen-cart",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":250,"apiVersion":251},"2026-10-18T17:22:44.123Z","3.0",{"rows":253,"total":11,"capped":17,"failed":11},[],[]]