Unrated severityNVD Advisory· Published Oct 21, 2008· Updated Apr 23, 2026
CVE-2008-4121
CVE-2008-4121
Description
Multiple cross-site scripting (XSS) vulnerabilities in cpCommerce before 1.2.4 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in a search.quick action to search.php and (2) the name parameter in a sendtofriend action to sendtofriend.php.
Affected products
17cpe:2.3:a:cpcommerce:cpcommerce:*:*:*:*:*:*:*:*+ 16 more
- cpe:2.3:a:cpcommerce:cpcommerce:*:*:*:*:*:*:*:*range: <=1.2.3
- cpe:2.3:a:cpcommerce:cpcommerce:0.5f:*:*:*:*:*:*:*
- cpe:2.3:a:cpcommerce:cpcommerce:1.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:cpcommerce:cpcommerce:1.0.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:cpcommerce:cpcommerce:1.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:cpcommerce:cpcommerce:1.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:cpcommerce:cpcommerce:1.0.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:cpcommerce:cpcommerce:1.0.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:cpcommerce:cpcommerce:1.0.7.3:*:*:*:*:*:*:*
- cpe:2.3:a:cpcommerce:cpcommerce:1.0.7.4:*:*:*:*:*:*:*
- cpe:2.3:a:cpcommerce:cpcommerce:1.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:cpcommerce:cpcommerce:1.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:cpcommerce:cpcommerce:1.0.9a:*:*:*:*:*:*:*
- cpe:2.3:a:cpcommerce:cpcommerce:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:cpcommerce:cpcommerce:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:cpcommerce:cpcommerce:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:cpcommerce:cpcommerce:1.2.2:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
8- www.datensalat.eu/~fabian/cve/CVE-2008-4121-cpcommerce.htmlnvdExploit
- cpcommerce.cpradio.orgnvdVendor Advisory
- secunia.com/advisories/32353nvdVendor Advisory
- securityreason.com/securityalert/4448nvd
- www.securityfocus.com/archive/1/497545/100/0/threadednvd
- www.securityfocus.com/bid/31825nvd
- www.securitytracker.com/idnvd
- exchange.xforce.ibmcloud.com/vulnerabilities/45970nvd
News mentions
0No linked articles in our index yet.