CVE-2004-2023: zen_cart

EPSS trend

Probability

1.81%

Chance of exploitation in the next 30 days

Percentile

78%

Versus all other CVEs

30-day change

0.00 pp

From 1.81% on 22-09-2026

22-09-202622-10-2026

EPSS score

1.81%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

10 links

exchange.xforce.ibmcloud.com/vulnerabilities/16176VDB EntryX Refsource XF
www.securityfocus.com/archive/1/434237/30/4950/threadedMailing ListX Refsource BUGTRAQ
securitytracker.com/id?1010172VDB EntryX Refsource SECTRACK
www.zen-cart.com/modules/ipb/index.php?showtopic=4835X Refsource CONFIRMVendor Advisory
www.packetstormsecurity.org/0405-advisories/zencart112d.txtX Refsource MISC
www.securityfocus.com/bid/10378VDB EntryX Refsource BID
www.osvdb.org/6298VDB EntryX Refsource OSVDB
marc.info?l=bugtraq&m=108489697219781&w=2Mailing ListX Refsource BUGTRAQ
secunia.com/advisories/11649Third Party AdvisoryX Refsource SECUNIAPatch
www.zen-cart.com/modules/mydownloads/viewcat.php?cid=31&orderby=dateDX Refsource CONFIRMPatch

Related vulnerabilities

CVE-2007-3597zen_cartzen_cart1.83%19y ago06-07-2007 18:00Session fixation vulnerability in Zen Cart 1.3.7 and earlier allows remote attackers to hijack web sessions by setting the Cookie parameter.CVE-2005-3997zen_cartzen_cart1.98%20y ago05-12-2005 00:00Zen Cart 1.2.6d and earlier, under certain PHP configurations, allows remote attackers to obtain sensitive information via direct requests to files in the admin/includes directory, including (1) graphs/banner_daily.php, (2) graphs/banner_infobox.php, (3) graphs/banner_yearly.php, (4) graphs/banner_monthly.php, (5) application_bottom.php, (6) attributes_preview.php, (7) modules/category_product_listing.php, (8) modules/copy_to_confirm.php, (9) modules/delete_product_confirm.php, and (10) modules/move_product_confirm.php, which leaks the web server path in the resulting error message.CVE-2008-6878zen_cartzen_cart2.34%17y ago27-07-2009 14:22Directory traversal vulnerability in admin/includes/languages/english.php in Zen Cart 1.3.8a, 1.3.8, and earlier, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the _SESSION[language] parameter. NOTE: the vendor disputes this issue, stating "at worst, the use of this vulnerability will reveal some local file paths.CVE-2008-6877zen_cartzen_cart2.34%17y ago27-07-2009 14:22Directory traversal vulnerability in admin/includes/initsystem.php in Zen Cart 1.3.8 and 1.3.8a, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the loader_file parameter. NOTE: the vendor disputes this issue, stating "at worst, the use of this vulnerability will reveal some local file paths.CVE-2004-2025zen_cartzen_cart1.11%21y ago10-05-2005 04:00SQL injection vulnerability in application_top.php for Zen Cart 1.1.3 before patch 2 may allow remote attackers to execute arbitrary SQL commands via the products_id parameter.CVE-2004-2024zen_cartzen_cart1.10%21y ago10-05-2005 04:00The distribution of Zen Cart 1.1.4 before patch 2 includes certain debugging code in the Admin password retrieval functionality, which allows attackers to gain administrative privileges via password_forgotten.php.

All vulnerabilities inzen_cart

CVE-2004-2023: zen_cart

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References