CVE-2011-4567

Zen-cart Zen Cart < 1.3.9 - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in includes/templates/template_default/templates/tpl_gv_send_default.php in Zen Cart before 1.5 allows remote attackers to inject arbitrary web script or HTML via the message parameter in a gv_send action to index.php, a different vulnerability than CVE-2011-4547.

Exploits (1)

exploitdb WORKING POC VERIFIED

by RPinto · textwebappsphp

https://www.exploit-db.com/exploits/36346

View Code ZIP pw:eip

References (3)

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/71519

[Exploit] https://www.dognaedis.com/vulns/DGS-SEC-8.html

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/50787

Scores

EPSS 0.0019

EPSS Percentile 40.3%

Classification

CWE

CWE-79

Status published

Affected Products (21)

zen-cart/zen_cart < 1.3.9

zen-cart/zen_cart

zen-cart/zen_cart

zen-cart/zen_cart

zen-cart/zen_cart

zen-cart/zen_cart

zen-cart/zen_cart

zen-cart/zen_cart

zen-cart/zen_cart

zen-cart/zen_cart

zen-cart/zen_cart

zen-cart/zen_cart

zen-cart/zen_cart

zen-cart/zen_cart

zen-cart/zen_cart

... and 6 more

Timeline

Published Nov 29, 2011

Tracked Since Feb 18, 2026