VYPR
← All advisories
Unrated severityNVD Advisory· Published May 27, 2012· Updated Jun 16, 2026

CVE-2012-1413

CVE-2012-1413

Description

Cross-site scripting (XSS) vulnerability in zc_install/includes/modules/pages/database_setup/header_php.php in Zen Cart 1.5.0 and earlier, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the db_username parameter to zc_install/index.php.

Affected products

25
  • Zen Cart/ZenCart25 versions
    cpe:2.3:a:zen-cart:zen_cart:*:*:*:*:*:*:*:*+ 24 more
    • cpe:2.3:a:zen-cart:zen_cart:*:*:*:*:*:*:*:*
    • cpe:2.3:a:zen-cart:zen_cart:1.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:zen-cart:zen_cart:1.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:zen-cart:zen_cart:1.2.0d:*:*:*:*:*:*:*
    • cpe:2.3:a:zen-cart:zen_cart:1.2.1d:*:*:*:*:*:*:*
    • cpe:2.3:a:zen-cart:zen_cart:1.2.1:patch1:*:*:*:*:*:*
    • cpe:2.3:a:zen-cart:zen_cart:1.2.1_patch1:*:*:*:*:*:*:*
    • cpe:2.3:a:zen-cart:zen_cart:1.2.2d:*:*:*:*:*:*:*
    • cpe:2.3:a:zen-cart:zen_cart:1.2.3d:*:*:*:*:*:*:*
    • cpe:2.3:a:zen-cart:zen_cart:1.2.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:zen-cart:zen_cart:1.2.4d:*:*:*:*:*:*:*
    • cpe:2.3:a:zen-cart:zen_cart:1.2.5d:*:*:*:*:*:*:*
    • cpe:2.3:a:zen-cart:zen_cart:1.2.6d:*:*:*:*:*:*:*
    • cpe:2.3:a:zen-cart:zen_cart:1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:zen-cart:zen_cart:1.3.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:zen-cart:zen_cart:1.3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:zen-cart:zen_cart:1.3.5:*:*:*:*:*:*:*
    • cpe:2.3:a:zen-cart:zen_cart:1.3.6:*:*:*:*:*:*:*
    • cpe:2.3:a:zen-cart:zen_cart:1.3.7:*:*:*:*:*:*:*
    • cpe:2.3:a:zen-cart:zen_cart:1.3.8:*:*:*:*:*:*:*
    • cpe:2.3:a:zen-cart:zen_cart:1.3.8a:*:*:*:*:*:*:*
    • cpe:2.3:a:zen-cart:zen_cart:1.3.9:*:*:*:*:*:*:*
    • cpe:2.3:a:zen-cart:zen_cart:1.3.9h:*:*:*:*:*:*:*
    • cpe:2.3:a:zen-cart:zen_cart:2008:*:*:*:*:*:*:*
    • (no CPE)range: <=1.5.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.