[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5-lpMN6-Gol2FAWnQhThfjBUU_663rG2AzZ_AG_7BSQ":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":20,"kevVulnerabilities":83,"topProductsByCves":84,"seoMetadata":86,"meta":95},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":19},36658,"zen-cart",1,27,0,48,"2024-08-21","z",[16],{"id":17,"product_name":18,"version_count":12,"cve_count":10,"kev_count":11,"last_cve_update":13},175493,"zen_cart","Zen-cart is a technology vendor with 1 tracked product and 27 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[21,29,37,43,51,56,62,68,73,78],{"cveId":22,"description":23,"publishedDate":13,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":27,"epssScore":28},"CVE-2024-5762","Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Zen Cart. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the findPluginAdminPage function. The issue results from the lack of proper validation of user-supplied data prior to passing it to a PHP include function. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the service account. Was ZDI-CAN-21408.",8.1,"v3.1","High",false,0.71598,{"cveId":30,"description":31,"publishedDate":32,"cvssScore":33,"cvssVersion":34,"severity":35,"isKev":27,"epssScore":36},"CVE-2009-2255","Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin\u002Frecord_company.php, which allows remote attackers to execute arbitrary code by uploading a .php file via the record_company_image parameter in conjunction with a PATH_INFO of password_forgotten.php, then accessing this file via a direct request to the file in images\u002F.","2009-06-30",6.8,"v2","Medium",0.30966,{"cveId":38,"description":39,"publishedDate":40,"cvssScore":41,"cvssVersion":25,"severity":26,"isKev":27,"epssScore":42},"CVE-2021-3291","Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.","2021-01-26",7.2,0.16782,{"cveId":44,"description":45,"publishedDate":46,"cvssScore":47,"cvssVersion":48,"severity":49,"isKev":27,"epssScore":50},"CVE-2015-8352","Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act parameter to ajax.php.","2017-08-24",9.8,"v3.0","Critical",0.15641,{"cveId":52,"description":53,"publishedDate":32,"cvssScore":54,"cvssVersion":34,"severity":26,"isKev":27,"epssScore":55},"CVE-2009-2254","Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin\u002Fsqlpatch.php, which allows remote attackers to execute arbitrary SQL commands via the query_string parameter in an execute action, in conjunction with a PATH_INFO of password_forgotten.php, related to a \"SQL Execution\" issue.",7.5,0.1089,{"cveId":57,"description":58,"publishedDate":59,"cvssScore":60,"cvssVersion":34,"severity":49,"isKev":27,"epssScore":61},"CVE-2006-0697","Zen Cart before 1.2.7 does not protect the admin\u002Fincludes directory, which allows remote attackers to cause unknown impact via unspecified vectors, probably direct requests.","2006-02-15",10,0.05223,{"cveId":63,"description":64,"publishedDate":65,"cvssScore":66,"cvssVersion":48,"severity":26,"isKev":27,"epssScore":67},"CVE-2017-11675","The traverseStrictSanitize function in admin_dir\u002Fincludes\u002Fclasses\u002FAdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which allows remote authenticated users to execute arbitrary PHP code by placing that code into an invalid array index of the admin_name array parameter to admin_dir\u002Flogin.php, if there is an export of an error-log entry for that invalid array index.","2017-07-27",8.8,0.02896,{"cveId":69,"description":70,"publishedDate":71,"cvssScore":33,"cvssVersion":34,"severity":35,"isKev":27,"epssScore":72},"CVE-2008-6986","SQL injection vulnerability in the actionMultipleAddProduct function in includes\u002Fclasses\u002Fshopping_cart.php in Zen Cart 1.3.0 through 1.3.8a, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the products_id array parameter in a multiple_products_add_product action, a different vulnerability than CVE-2008-6985.","2009-08-19",0.02808,{"cveId":74,"description":75,"publishedDate":76,"cvssScore":54,"cvssVersion":34,"severity":26,"isKev":27,"epssScore":77},"CVE-2009-4323","The installation for Zen Cart stores sensitive information and insecure programs under the (1) docs, (2) extras, and (3) zc_install folders, and (4) install.txt, which allows remote attackers to obtain sensitive information, delete the database, and conduct other attacks via a direct request, different vulnerabilities than CVE-2009-4321 and CVE-2009-4322.","2009-12-14",0.02579,{"cveId":79,"description":80,"publishedDate":76,"cvssScore":81,"cvssVersion":34,"severity":35,"isKev":27,"epssScore":82},"CVE-2009-4321","extras\u002Fcurltest.php in Zen Cart 1.3.8 and 1.3.8a, and possibly other versions, allows remote attackers to read arbitrary files via a file:\u002F\u002F URI.  NOTE: some of these details are obtained from third party information.",5,0.0249,[],[85],{"id":17,"product_name":18,"version_count":12,"cve_count":10,"kev_count":11,"last_cve_update":13},{"title":87,"metaDescription":88,"keywords":89,"structuredData":90},"Zen-cart - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Zen-cart covering 1 product with 27 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Zen-cart vulnerabilities, Zen-cart security, Zen-cart CVE, Zen-cart threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":91,"@type":92,"name":93,"description":88,"url":94},"https:\u002F\u002Fschema.org","Organization","Zen-cart","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fzen-cart",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":96,"apiVersion":97},"2026-10-18T17:22:44.171Z","3.0"]