Cpcommerce: >> Cpcommerce >> 1.0.7.2 Security Vulnerabilities
Cross-site scripting (XSS) vulnerability in cpCommerce before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via unknown vectors in the advanced search feature. NOTE: this is probably a variant of CVE-2008-4121.
CVSS Score
4.3
EPSS Score
0.003
Published
2008-10-21
Multiple cross-site scripting (XSS) vulnerabilities in cpCommerce before 1.2.4 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in a search.quick action to search.php and (2) the name parameter in a sendtofriend action to sendtofriend.php.
CVSS Score
4.3
EPSS Score
0.005
Published
2008-10-21
SQL injection vulnerability in manufacturer.php in cpCommerce before 1.1.0 allows remote attackers to execute arbitrary SQL commands via the id_manufacturer parameter.
CVSS Score
7.5
EPSS Score
0.01
Published
2007-05-31