Search criteria

32 vulnerabilities found for cpcommerce by cpcommerce

CVE-2009-1936 (GCVE-0-2009-1936)

Vulnerability from cvelistv5 – Published: 2009-06-05 18:13 – Updated: 2025-01-21 15:24
VLAI?
Summary
_functions.php in cpCommerce 1.2.x, possibly including 1.2.9, sends a redirect but does not exit when it is called directly, which allows remote attackers to bypass a protection mechanism to conduct remote file inclusion and directory traversal attacks, execute arbitrary PHP code, or read arbitrary files via the GLOBALS[prefix] parameter, a different vector than CVE-2003-1500.
Severity ?
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • n/a
Assigner
References
https://www.exploit-db.com/exploits/8790 exploitx_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/35103 vdb-entryx_refsource_BID
http://secunia.com/advisories/35245 third-party-advisoryx_refsource_SECUNIA
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:27:54.827Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "8790",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/8790"
          },
          {
            "name": "35103",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/35103"
          },
          {
            "name": "35245",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35245"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2009-1936",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-31T16:10:12.926143Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-21T15:24:30.768Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-05-26T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "_functions.php in cpCommerce 1.2.x, possibly including 1.2.9, sends a redirect but does not exit when it is called directly, which allows remote attackers to bypass a protection mechanism to conduct remote file inclusion and directory traversal attacks, execute arbitrary PHP code, or read arbitrary files via the GLOBALS[prefix] parameter, a different vector than CVE-2003-1500."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "8790",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/8790"
        },
        {
          "name": "35103",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/35103"
        },
        {
          "name": "35245",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35245"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-1936",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "_functions.php in cpCommerce 1.2.x, possibly including 1.2.9, sends a redirect but does not exit when it is called directly, which allows remote attackers to bypass a protection mechanism to conduct remote file inclusion and directory traversal attacks, execute arbitrary PHP code, or read arbitrary files via the GLOBALS[prefix] parameter, a different vector than CVE-2003-1500."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "8790",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/8790"
            },
            {
              "name": "35103",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/35103"
            },
            {
              "name": "35245",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/35245"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-1936",
    "datePublished": "2009-06-05T18:13:00",
    "dateReserved": "2009-06-05T00:00:00",
    "dateUpdated": "2025-01-21T15:24:30.768Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2009-1345 (GCVE-0-2009-1345)

Vulnerability from cvelistv5 – Published: 2009-04-20 14:06 – Updated: 2024-08-07 05:13
VLAI?
Summary
SQL injection vulnerability in document.php in cpCommerce 1.2.8 allows remote attackers to execute arbitrary SQL commands via the id_document parameter.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://www.securitytracker.com/id?1022082 vdb-entryx_refsource_SECTRACK
https://www.exploit-db.com/exploits/8455 exploitx_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/34556 vdb-entryx_refsource_BID
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:13:25.182Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1022082",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1022082"
          },
          {
            "name": "8455",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/8455"
          },
          {
            "name": "34556",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/34556"
          },
          {
            "name": "cpcommerce-document-sql-injection(49901)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49901"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-04-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "SQL injection vulnerability in document.php in cpCommerce 1.2.8 allows remote attackers to execute arbitrary SQL commands via the id_document parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "1022082",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1022082"
        },
        {
          "name": "8455",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/8455"
        },
        {
          "name": "34556",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/34556"
        },
        {
          "name": "cpcommerce-document-sql-injection(49901)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49901"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-1345",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SQL injection vulnerability in document.php in cpCommerce 1.2.8 allows remote attackers to execute arbitrary SQL commands via the id_document parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1022082",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1022082"
            },
            {
              "name": "8455",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/8455"
            },
            {
              "name": "34556",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/34556"
            },
            {
              "name": "cpcommerce-document-sql-injection(49901)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49901"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-1345",
    "datePublished": "2009-04-20T14:06:00",
    "dateReserved": "2009-04-20T00:00:00",
    "dateUpdated": "2024-08-07T05:13:25.182Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2008-4121 (GCVE-0-2008-4121)

Vulnerability from cvelistv5 – Published: 2008-10-21 16:00 – Updated: 2024-08-07 10:08
VLAI?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in cpCommerce before 1.2.4 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in a search.quick action to search.php and (2) the name parameter in a sendtofriend action to sendtofriend.php.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://cpcommerce.cpradio.org/ x_refsource_CONFIRM
http://www.securitytracker.com/id?1021070 vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/archive/1/497545/100… mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/31825 vdb-entryx_refsource_BID
http://secunia.com/advisories/32353 third-party-advisoryx_refsource_SECUNIA
http://securityreason.com/securityalert/4448 third-party-advisoryx_refsource_SREASON
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://www.datensalat.eu/~fabian/cve/CVE-2008-412… x_refsource_MISC
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T10:08:33.628Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://cpcommerce.cpradio.org/"
          },
          {
            "name": "1021070",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1021070"
          },
          {
            "name": "20081019 Cross Site Scripting (XSS) Vulnerabilitiy in cpcommerce, CVE-2008-4121",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/497545/100/0/threaded"
          },
          {
            "name": "31825",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/31825"
          },
          {
            "name": "32353",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32353"
          },
          {
            "name": "4448",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/4448"
          },
          {
            "name": "cpcommerce-search-sendtofriend-xss(45970)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45970"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.datensalat.eu/~fabian/cve/CVE-2008-4121-cpcommerce.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-10-19T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in cpCommerce before 1.2.4 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in a search.quick action to search.php and (2) the name parameter in a sendtofriend action to sendtofriend.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-11T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://cpcommerce.cpradio.org/"
        },
        {
          "name": "1021070",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1021070"
        },
        {
          "name": "20081019 Cross Site Scripting (XSS) Vulnerabilitiy in cpcommerce, CVE-2008-4121",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/497545/100/0/threaded"
        },
        {
          "name": "31825",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/31825"
        },
        {
          "name": "32353",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32353"
        },
        {
          "name": "4448",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/4448"
        },
        {
          "name": "cpcommerce-search-sendtofriend-xss(45970)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45970"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.datensalat.eu/~fabian/cve/CVE-2008-4121-cpcommerce.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-4121",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in cpCommerce before 1.2.4 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in a search.quick action to search.php and (2) the name parameter in a sendtofriend action to sendtofriend.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://cpcommerce.cpradio.org/",
              "refsource": "CONFIRM",
              "url": "http://cpcommerce.cpradio.org/"
            },
            {
              "name": "1021070",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1021070"
            },
            {
              "name": "20081019 Cross Site Scripting (XSS) Vulnerabilitiy in cpcommerce, CVE-2008-4121",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/497545/100/0/threaded"
            },
            {
              "name": "31825",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/31825"
            },
            {
              "name": "32353",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32353"
            },
            {
              "name": "4448",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/4448"
            },
            {
              "name": "cpcommerce-search-sendtofriend-xss(45970)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45970"
            },
            {
              "name": "http://www.datensalat.eu/~fabian/cve/CVE-2008-4121-cpcommerce.html",
              "refsource": "MISC",
              "url": "http://www.datensalat.eu/~fabian/cve/CVE-2008-4121-cpcommerce.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-4121",
    "datePublished": "2008-10-21T16:00:00",
    "dateReserved": "2008-09-18T00:00:00",
    "dateUpdated": "2024-08-07T10:08:33.628Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2008-4637 (GCVE-0-2008-4637)

Vulnerability from cvelistv5 – Published: 2008-10-21 16:00 – Updated: 2024-08-07 10:24
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in cpCommerce before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via unknown vectors in the advanced search feature. NOTE: this is probably a variant of CVE-2008-4121.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T10:24:20.581Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://cpcommerce.cpradio.org/"
          },
          {
            "name": "cpcommerce-advancedsearch-xss(46090)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46090"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-09-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in cpCommerce before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via unknown vectors in the advanced search feature.  NOTE: this is probably a variant of CVE-2008-4121."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-07T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://cpcommerce.cpradio.org/"
        },
        {
          "name": "cpcommerce-advancedsearch-xss(46090)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46090"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-4637",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in cpCommerce before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via unknown vectors in the advanced search feature.  NOTE: this is probably a variant of CVE-2008-4121."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://cpcommerce.cpradio.org/",
              "refsource": "CONFIRM",
              "url": "http://cpcommerce.cpradio.org/"
            },
            {
              "name": "cpcommerce-advancedsearch-xss(46090)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46090"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-4637",
    "datePublished": "2008-10-21T16:00:00",
    "dateReserved": "2008-10-21T00:00:00",
    "dateUpdated": "2024-08-07T10:24:20.581Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2008-1906 (GCVE-0-2008-1906)

Vulnerability from cvelistv5 – Published: 2008-04-21 23:00 – Updated: 2024-08-07 08:40
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in calendar.php in cpCommerce 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the year parameter in a view.year action.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://www.securityfocus.com/bid/28755 vdb-entryx_refsource_BID
http://bugreport.ir/index.php?/34 x_refsource_MISC
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://www.vupen.com/english/advisories/2008/1213… vdb-entryx_refsource_VUPEN
http://secunia.com/advisories/29807 third-party-advisoryx_refsource_SECUNIA
https://www.exploit-db.com/exploits/5437 exploitx_refsource_EXPLOIT-DB
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T08:40:59.233Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "28755",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/28755"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://bugreport.ir/index.php?/34"
          },
          {
            "name": "cpcommerce-calendar-xss(41780)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41780"
          },
          {
            "name": "ADV-2008-1213",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/1213/references"
          },
          {
            "name": "29807",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/29807"
          },
          {
            "name": "5437",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/5437"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-04-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in calendar.php in cpCommerce 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the year parameter in a view.year action."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "28755",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/28755"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://bugreport.ir/index.php?/34"
        },
        {
          "name": "cpcommerce-calendar-xss(41780)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41780"
        },
        {
          "name": "ADV-2008-1213",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/1213/references"
        },
        {
          "name": "29807",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/29807"
        },
        {
          "name": "5437",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/5437"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-1906",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in calendar.php in cpCommerce 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the year parameter in a view.year action."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "28755",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/28755"
            },
            {
              "name": "http://bugreport.ir/index.php?/34",
              "refsource": "MISC",
              "url": "http://bugreport.ir/index.php?/34"
            },
            {
              "name": "cpcommerce-calendar-xss(41780)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41780"
            },
            {
              "name": "ADV-2008-1213",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/1213/references"
            },
            {
              "name": "29807",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/29807"
            },
            {
              "name": "5437",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/5437"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-1906",
    "datePublished": "2008-04-21T23:00:00",
    "dateReserved": "2008-04-21T00:00:00",
    "dateUpdated": "2024-08-07T08:40:59.233Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2008-1908 (GCVE-0-2008-1908)

Vulnerability from cvelistv5 – Published: 2008-04-21 23:00 – Updated: 2024-08-07 08:40
VLAI?
Summary
Multiple directory traversal vulnerabilities in cpCommerce 1.1.0 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the language parameter in a language action to the default URI, which is not properly handled in actions/language.act.php, or (2) the action parameter to category.php.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://www.securityfocus.com/bid/28755 vdb-entryx_refsource_BID
http://bugreport.ir/index.php?/34 x_refsource_MISC
http://www.vupen.com/english/advisories/2008/1213… vdb-entryx_refsource_VUPEN
http://secunia.com/advisories/29807 third-party-advisoryx_refsource_SECUNIA
https://www.exploit-db.com/exploits/5437 exploitx_refsource_EXPLOIT-DB
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T08:40:59.759Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "28755",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/28755"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://bugreport.ir/index.php?/34"
          },
          {
            "name": "ADV-2008-1213",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/1213/references"
          },
          {
            "name": "29807",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/29807"
          },
          {
            "name": "5437",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/5437"
          },
          {
            "name": "cpcommerce-multiple-file-include(41783)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41783"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-04-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple directory traversal vulnerabilities in cpCommerce 1.1.0 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the language parameter in a language action to the default URI, which is not properly handled in actions/language.act.php, or (2) the action parameter to category.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "28755",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/28755"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://bugreport.ir/index.php?/34"
        },
        {
          "name": "ADV-2008-1213",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/1213/references"
        },
        {
          "name": "29807",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/29807"
        },
        {
          "name": "5437",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/5437"
        },
        {
          "name": "cpcommerce-multiple-file-include(41783)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41783"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-1908",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple directory traversal vulnerabilities in cpCommerce 1.1.0 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the language parameter in a language action to the default URI, which is not properly handled in actions/language.act.php, or (2) the action parameter to category.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "28755",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/28755"
            },
            {
              "name": "http://bugreport.ir/index.php?/34",
              "refsource": "MISC",
              "url": "http://bugreport.ir/index.php?/34"
            },
            {
              "name": "ADV-2008-1213",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/1213/references"
            },
            {
              "name": "29807",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/29807"
            },
            {
              "name": "5437",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/5437"
            },
            {
              "name": "cpcommerce-multiple-file-include(41783)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41783"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-1908",
    "datePublished": "2008-04-21T23:00:00",
    "dateReserved": "2008-04-21T00:00:00",
    "dateUpdated": "2024-08-07T08:40:59.759Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2008-1907 (GCVE-0-2008-1907)

Vulnerability from cvelistv5 – Published: 2008-04-21 23:00 – Updated: 2024-08-07 08:40
VLAI?
Summary
Multiple SQL injection vulnerabilities in functions/display_page.func.php in cpCommerce 1.1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id_product, (2) id_manufacturer, and (3) id_category parameters to unspecified components. NOTE: this probably overlaps CVE-2007-2959 and CVE-2007-2890.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://www.securityfocus.com/bid/28755 vdb-entryx_refsource_BID
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://bugreport.ir/index.php?/34 x_refsource_MISC
http://secunia.com/advisories/29807 third-party-advisoryx_refsource_SECUNIA
https://www.exploit-db.com/exploits/5437 exploitx_refsource_EXPLOIT-DB
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T08:40:59.243Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "28755",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/28755"
          },
          {
            "name": "cpcommerce-index-sql-injection(41781)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41781"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://bugreport.ir/index.php?/34"
          },
          {
            "name": "29807",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/29807"
          },
          {
            "name": "5437",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/5437"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-04-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple SQL injection vulnerabilities in functions/display_page.func.php in cpCommerce 1.1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id_product, (2) id_manufacturer, and (3) id_category parameters to unspecified components.  NOTE: this probably overlaps CVE-2007-2959 and CVE-2007-2890."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "28755",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/28755"
        },
        {
          "name": "cpcommerce-index-sql-injection(41781)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41781"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://bugreport.ir/index.php?/34"
        },
        {
          "name": "29807",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/29807"
        },
        {
          "name": "5437",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/5437"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-1907",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple SQL injection vulnerabilities in functions/display_page.func.php in cpCommerce 1.1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id_product, (2) id_manufacturer, and (3) id_category parameters to unspecified components.  NOTE: this probably overlaps CVE-2007-2959 and CVE-2007-2890."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "28755",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/28755"
            },
            {
              "name": "cpcommerce-index-sql-injection(41781)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41781"
            },
            {
              "name": "http://bugreport.ir/index.php?/34",
              "refsource": "MISC",
              "url": "http://bugreport.ir/index.php?/34"
            },
            {
              "name": "29807",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/29807"
            },
            {
              "name": "5437",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/5437"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-1907",
    "datePublished": "2008-04-21T23:00:00",
    "dateReserved": "2008-04-21T00:00:00",
    "dateUpdated": "2024-08-07T08:40:59.243Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2003-1500 (GCVE-0-2003-1500)

Vulnerability from cvelistv5 – Published: 2007-10-25 19:00 – Updated: 2024-08-08 02:28
VLAI?
Summary
PHP remote file inclusion vulnerability in _functions.php in cpCommerce 0.5f allows remote attackers to execute arbitrary code via the prefix parameter.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T02:28:03.622Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.securiteam.com/unixfocus/6H00E2K8KG.html"
          },
          {
            "name": "8851",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/8851"
          },
          {
            "name": "20031019 ZH2003-31SA (security advisory): file inclusion vulnerability in cpCommerce",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/341757"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://cpcommerce.org/forums/index.php?board=2%3Baction=display%3Bthreadid=864"
          },
          {
            "name": "3301",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/3301"
          },
          {
            "name": "cpCommerce-functionsphp-file-include(13457)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13457"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2003-10-19T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "PHP remote file inclusion vulnerability in _functions.php in cpCommerce 0.5f allows remote attackers to execute arbitrary code via the prefix parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.securiteam.com/unixfocus/6H00E2K8KG.html"
        },
        {
          "name": "8851",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/8851"
        },
        {
          "name": "20031019 ZH2003-31SA (security advisory): file inclusion vulnerability in cpCommerce",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/341757"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://cpcommerce.org/forums/index.php?board=2%3Baction=display%3Bthreadid=864"
        },
        {
          "name": "3301",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/3301"
        },
        {
          "name": "cpCommerce-functionsphp-file-include(13457)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13457"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2003-1500",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PHP remote file inclusion vulnerability in _functions.php in cpCommerce 0.5f allows remote attackers to execute arbitrary code via the prefix parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.securiteam.com/unixfocus/6H00E2K8KG.html",
              "refsource": "MISC",
              "url": "http://www.securiteam.com/unixfocus/6H00E2K8KG.html"
            },
            {
              "name": "8851",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/8851"
            },
            {
              "name": "20031019 ZH2003-31SA (security advisory): file inclusion vulnerability in cpCommerce",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/341757"
            },
            {
              "name": "http://cpcommerce.org/forums/index.php?board=2;action=display;threadid=864",
              "refsource": "CONFIRM",
              "url": "http://cpcommerce.org/forums/index.php?board=2;action=display;threadid=864"
            },
            {
              "name": "3301",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/3301"
            },
            {
              "name": "cpCommerce-functionsphp-file-include(13457)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13457"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2003-1500",
    "datePublished": "2007-10-25T19:00:00",
    "dateReserved": "2007-10-25T00:00:00",
    "dateUpdated": "2024-08-08T02:28:03.622Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2007-2968 (GCVE-0-2007-2968)

Vulnerability from cvelistv5 – Published: 2007-06-01 01:00 – Updated: 2024-08-07 13:57
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in register.php in cpCommerce 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the name parameter (Full Name field).
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://osvdb.org/36697 vdb-entryx_refsource_OSVDB
http://www.securityfocus.com/bid/24166 vdb-entryx_refsource_BID
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://secunia.com/advisories/25424 third-party-advisoryx_refsource_SECUNIA
http://securityreason.com/securityalert/2761 third-party-advisoryx_refsource_SREASON
http://www.securityfocus.com/archive/1/469595/100… mailing-listx_refsource_BUGTRAQ
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T13:57:54.892Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "36697",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/36697"
          },
          {
            "name": "24166",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/24166"
          },
          {
            "name": "cpcommerce-fullname-xss(34517)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34517"
          },
          {
            "name": "25424",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/25424"
          },
          {
            "name": "2761",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/2761"
          },
          {
            "name": "20070525 Vulnerability - cpCommerce - XSS",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/469595/100/0/threaded"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-05-25T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in register.php in cpCommerce 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the name parameter (Full Name field)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-16T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "36697",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/36697"
        },
        {
          "name": "24166",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/24166"
        },
        {
          "name": "cpcommerce-fullname-xss(34517)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34517"
        },
        {
          "name": "25424",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/25424"
        },
        {
          "name": "2761",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/2761"
        },
        {
          "name": "20070525 Vulnerability - cpCommerce - XSS",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/469595/100/0/threaded"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-2968",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in register.php in cpCommerce 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the name parameter (Full Name field)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "36697",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/36697"
            },
            {
              "name": "24166",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/24166"
            },
            {
              "name": "cpcommerce-fullname-xss(34517)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34517"
            },
            {
              "name": "25424",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/25424"
            },
            {
              "name": "2761",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/2761"
            },
            {
              "name": "20070525 Vulnerability - cpCommerce - XSS",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/469595/100/0/threaded"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-2968",
    "datePublished": "2007-06-01T01:00:00",
    "dateReserved": "2007-05-31T00:00:00",
    "dateUpdated": "2024-08-07T13:57:54.892Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2007-2959 (GCVE-0-2007-2959)

Vulnerability from cvelistv5 – Published: 2007-05-31 23:00 – Updated: 2024-08-07 13:57
VLAI?
Summary
SQL injection vulnerability in manufacturer.php in cpCommerce before 1.1.0 allows remote attackers to execute arbitrary SQL commands via the id_manufacturer parameter.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://osvdb.org/38042 vdb-entryx_refsource_OSVDB
http://securityreason.com/securityalert/2747 third-party-advisoryx_refsource_SREASON
http://www.securityfocus.com/bid/24223 vdb-entryx_refsource_BID
http://www.securityfocus.com/archive/1/469910/100… mailing-listx_refsource_BUGTRAQ
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T13:57:54.715Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "cpcommerce-manufacturer-sql-injection(34573)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34573"
          },
          {
            "name": "38042",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/38042"
          },
          {
            "name": "2747",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/2747"
          },
          {
            "name": "24223",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/24223"
          },
          {
            "name": "20070529 cpcommerce \u003c v1.1.0 [sql injection]",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/469910/100/0/threaded"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-05-29T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "SQL injection vulnerability in manufacturer.php in cpCommerce before 1.1.0 allows remote attackers to execute arbitrary SQL commands via the id_manufacturer parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-16T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "cpcommerce-manufacturer-sql-injection(34573)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34573"
        },
        {
          "name": "38042",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/38042"
        },
        {
          "name": "2747",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/2747"
        },
        {
          "name": "24223",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/24223"
        },
        {
          "name": "20070529 cpcommerce \u003c v1.1.0 [sql injection]",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/469910/100/0/threaded"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-2959",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SQL injection vulnerability in manufacturer.php in cpCommerce before 1.1.0 allows remote attackers to execute arbitrary SQL commands via the id_manufacturer parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "cpcommerce-manufacturer-sql-injection(34573)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34573"
            },
            {
              "name": "38042",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/38042"
            },
            {
              "name": "2747",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/2747"
            },
            {
              "name": "24223",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/24223"
            },
            {
              "name": "20070529 cpcommerce \u003c v1.1.0 [sql injection]",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/469910/100/0/threaded"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-2959",
    "datePublished": "2007-05-31T23:00:00",
    "dateReserved": "2007-05-31T00:00:00",
    "dateUpdated": "2024-08-07T13:57:54.715Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2007-2890 (GCVE-0-2007-2890)

Vulnerability from cvelistv5 – Published: 2007-05-30 01:00 – Updated: 2024-08-07 13:57
VLAI?
Summary
SQL injection vulnerability in category.php in cpCommerce 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id_category parameter.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
https://www.exploit-db.com/exploits/3981 exploitx_refsource_EXPLOIT-DB
http://secunia.com/advisories/25412 third-party-advisoryx_refsource_SECUNIA
http://www.vupen.com/english/advisories/2007/1956 vdb-entryx_refsource_VUPEN
http://www.securityfocus.com/bid/24138 vdb-entryx_refsource_BID
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://osvdb.org/36315 vdb-entryx_refsource_OSVDB
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T13:57:54.477Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "3981",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/3981"
          },
          {
            "name": "25412",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/25412"
          },
          {
            "name": "ADV-2007-1956",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/1956"
          },
          {
            "name": "24138",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/24138"
          },
          {
            "name": "cpcommerce-category-sql-injection(34484)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34484"
          },
          {
            "name": "36315",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/36315"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-05-24T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "SQL injection vulnerability in category.php in cpCommerce 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id_category parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-10T00:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "3981",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/3981"
        },
        {
          "name": "25412",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/25412"
        },
        {
          "name": "ADV-2007-1956",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/1956"
        },
        {
          "name": "24138",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/24138"
        },
        {
          "name": "cpcommerce-category-sql-injection(34484)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34484"
        },
        {
          "name": "36315",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/36315"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-2890",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SQL injection vulnerability in category.php in cpCommerce 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id_category parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "3981",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/3981"
            },
            {
              "name": "25412",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/25412"
            },
            {
              "name": "ADV-2007-1956",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/1956"
            },
            {
              "name": "24138",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/24138"
            },
            {
              "name": "cpcommerce-category-sql-injection(34484)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34484"
            },
            {
              "name": "36315",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/36315"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-2890",
    "datePublished": "2007-05-30T01:00:00",
    "dateReserved": "2007-05-29T00:00:00",
    "dateUpdated": "2024-08-07T13:57:54.477Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2009-1936 (GCVE-0-2009-1936)

Vulnerability from nvd – Published: 2009-06-05 18:13 – Updated: 2025-01-21 15:24
VLAI?
Summary
_functions.php in cpCommerce 1.2.x, possibly including 1.2.9, sends a redirect but does not exit when it is called directly, which allows remote attackers to bypass a protection mechanism to conduct remote file inclusion and directory traversal attacks, execute arbitrary PHP code, or read arbitrary files via the GLOBALS[prefix] parameter, a different vector than CVE-2003-1500.
Severity ?
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • n/a
Assigner
References
https://www.exploit-db.com/exploits/8790 exploitx_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/35103 vdb-entryx_refsource_BID
http://secunia.com/advisories/35245 third-party-advisoryx_refsource_SECUNIA
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:27:54.827Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "8790",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/8790"
          },
          {
            "name": "35103",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/35103"
          },
          {
            "name": "35245",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35245"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2009-1936",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-31T16:10:12.926143Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-21T15:24:30.768Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-05-26T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "_functions.php in cpCommerce 1.2.x, possibly including 1.2.9, sends a redirect but does not exit when it is called directly, which allows remote attackers to bypass a protection mechanism to conduct remote file inclusion and directory traversal attacks, execute arbitrary PHP code, or read arbitrary files via the GLOBALS[prefix] parameter, a different vector than CVE-2003-1500."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "8790",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/8790"
        },
        {
          "name": "35103",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/35103"
        },
        {
          "name": "35245",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35245"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-1936",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "_functions.php in cpCommerce 1.2.x, possibly including 1.2.9, sends a redirect but does not exit when it is called directly, which allows remote attackers to bypass a protection mechanism to conduct remote file inclusion and directory traversal attacks, execute arbitrary PHP code, or read arbitrary files via the GLOBALS[prefix] parameter, a different vector than CVE-2003-1500."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "8790",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/8790"
            },
            {
              "name": "35103",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/35103"
            },
            {
              "name": "35245",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/35245"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-1936",
    "datePublished": "2009-06-05T18:13:00",
    "dateReserved": "2009-06-05T00:00:00",
    "dateUpdated": "2025-01-21T15:24:30.768Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2009-1345 (GCVE-0-2009-1345)

Vulnerability from nvd – Published: 2009-04-20 14:06 – Updated: 2024-08-07 05:13
VLAI?
Summary
SQL injection vulnerability in document.php in cpCommerce 1.2.8 allows remote attackers to execute arbitrary SQL commands via the id_document parameter.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://www.securitytracker.com/id?1022082 vdb-entryx_refsource_SECTRACK
https://www.exploit-db.com/exploits/8455 exploitx_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/34556 vdb-entryx_refsource_BID
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:13:25.182Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1022082",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1022082"
          },
          {
            "name": "8455",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/8455"
          },
          {
            "name": "34556",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/34556"
          },
          {
            "name": "cpcommerce-document-sql-injection(49901)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49901"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-04-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "SQL injection vulnerability in document.php in cpCommerce 1.2.8 allows remote attackers to execute arbitrary SQL commands via the id_document parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "1022082",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1022082"
        },
        {
          "name": "8455",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/8455"
        },
        {
          "name": "34556",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/34556"
        },
        {
          "name": "cpcommerce-document-sql-injection(49901)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49901"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-1345",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SQL injection vulnerability in document.php in cpCommerce 1.2.8 allows remote attackers to execute arbitrary SQL commands via the id_document parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1022082",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1022082"
            },
            {
              "name": "8455",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/8455"
            },
            {
              "name": "34556",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/34556"
            },
            {
              "name": "cpcommerce-document-sql-injection(49901)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49901"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-1345",
    "datePublished": "2009-04-20T14:06:00",
    "dateReserved": "2009-04-20T00:00:00",
    "dateUpdated": "2024-08-07T05:13:25.182Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2008-4121 (GCVE-0-2008-4121)

Vulnerability from nvd – Published: 2008-10-21 16:00 – Updated: 2024-08-07 10:08
VLAI?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in cpCommerce before 1.2.4 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in a search.quick action to search.php and (2) the name parameter in a sendtofriend action to sendtofriend.php.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://cpcommerce.cpradio.org/ x_refsource_CONFIRM
http://www.securitytracker.com/id?1021070 vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/archive/1/497545/100… mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/31825 vdb-entryx_refsource_BID
http://secunia.com/advisories/32353 third-party-advisoryx_refsource_SECUNIA
http://securityreason.com/securityalert/4448 third-party-advisoryx_refsource_SREASON
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://www.datensalat.eu/~fabian/cve/CVE-2008-412… x_refsource_MISC
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T10:08:33.628Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://cpcommerce.cpradio.org/"
          },
          {
            "name": "1021070",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1021070"
          },
          {
            "name": "20081019 Cross Site Scripting (XSS) Vulnerabilitiy in cpcommerce, CVE-2008-4121",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/497545/100/0/threaded"
          },
          {
            "name": "31825",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/31825"
          },
          {
            "name": "32353",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32353"
          },
          {
            "name": "4448",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/4448"
          },
          {
            "name": "cpcommerce-search-sendtofriend-xss(45970)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45970"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.datensalat.eu/~fabian/cve/CVE-2008-4121-cpcommerce.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-10-19T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in cpCommerce before 1.2.4 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in a search.quick action to search.php and (2) the name parameter in a sendtofriend action to sendtofriend.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-11T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://cpcommerce.cpradio.org/"
        },
        {
          "name": "1021070",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1021070"
        },
        {
          "name": "20081019 Cross Site Scripting (XSS) Vulnerabilitiy in cpcommerce, CVE-2008-4121",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/497545/100/0/threaded"
        },
        {
          "name": "31825",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/31825"
        },
        {
          "name": "32353",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32353"
        },
        {
          "name": "4448",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/4448"
        },
        {
          "name": "cpcommerce-search-sendtofriend-xss(45970)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45970"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.datensalat.eu/~fabian/cve/CVE-2008-4121-cpcommerce.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-4121",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in cpCommerce before 1.2.4 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in a search.quick action to search.php and (2) the name parameter in a sendtofriend action to sendtofriend.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://cpcommerce.cpradio.org/",
              "refsource": "CONFIRM",
              "url": "http://cpcommerce.cpradio.org/"
            },
            {
              "name": "1021070",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1021070"
            },
            {
              "name": "20081019 Cross Site Scripting (XSS) Vulnerabilitiy in cpcommerce, CVE-2008-4121",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/497545/100/0/threaded"
            },
            {
              "name": "31825",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/31825"
            },
            {
              "name": "32353",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32353"
            },
            {
              "name": "4448",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/4448"
            },
            {
              "name": "cpcommerce-search-sendtofriend-xss(45970)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45970"
            },
            {
              "name": "http://www.datensalat.eu/~fabian/cve/CVE-2008-4121-cpcommerce.html",
              "refsource": "MISC",
              "url": "http://www.datensalat.eu/~fabian/cve/CVE-2008-4121-cpcommerce.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-4121",
    "datePublished": "2008-10-21T16:00:00",
    "dateReserved": "2008-09-18T00:00:00",
    "dateUpdated": "2024-08-07T10:08:33.628Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2008-4637 (GCVE-0-2008-4637)

Vulnerability from nvd – Published: 2008-10-21 16:00 – Updated: 2024-08-07 10:24
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in cpCommerce before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via unknown vectors in the advanced search feature. NOTE: this is probably a variant of CVE-2008-4121.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T10:24:20.581Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://cpcommerce.cpradio.org/"
          },
          {
            "name": "cpcommerce-advancedsearch-xss(46090)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46090"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-09-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in cpCommerce before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via unknown vectors in the advanced search feature.  NOTE: this is probably a variant of CVE-2008-4121."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-07T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://cpcommerce.cpradio.org/"
        },
        {
          "name": "cpcommerce-advancedsearch-xss(46090)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46090"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-4637",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in cpCommerce before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via unknown vectors in the advanced search feature.  NOTE: this is probably a variant of CVE-2008-4121."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://cpcommerce.cpradio.org/",
              "refsource": "CONFIRM",
              "url": "http://cpcommerce.cpradio.org/"
            },
            {
              "name": "cpcommerce-advancedsearch-xss(46090)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46090"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-4637",
    "datePublished": "2008-10-21T16:00:00",
    "dateReserved": "2008-10-21T00:00:00",
    "dateUpdated": "2024-08-07T10:24:20.581Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2008-1906 (GCVE-0-2008-1906)

Vulnerability from nvd – Published: 2008-04-21 23:00 – Updated: 2024-08-07 08:40
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in calendar.php in cpCommerce 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the year parameter in a view.year action.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://www.securityfocus.com/bid/28755 vdb-entryx_refsource_BID
http://bugreport.ir/index.php?/34 x_refsource_MISC
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://www.vupen.com/english/advisories/2008/1213… vdb-entryx_refsource_VUPEN
http://secunia.com/advisories/29807 third-party-advisoryx_refsource_SECUNIA
https://www.exploit-db.com/exploits/5437 exploitx_refsource_EXPLOIT-DB
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T08:40:59.233Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "28755",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/28755"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://bugreport.ir/index.php?/34"
          },
          {
            "name": "cpcommerce-calendar-xss(41780)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41780"
          },
          {
            "name": "ADV-2008-1213",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/1213/references"
          },
          {
            "name": "29807",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/29807"
          },
          {
            "name": "5437",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/5437"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-04-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in calendar.php in cpCommerce 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the year parameter in a view.year action."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "28755",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/28755"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://bugreport.ir/index.php?/34"
        },
        {
          "name": "cpcommerce-calendar-xss(41780)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41780"
        },
        {
          "name": "ADV-2008-1213",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/1213/references"
        },
        {
          "name": "29807",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/29807"
        },
        {
          "name": "5437",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/5437"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-1906",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in calendar.php in cpCommerce 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the year parameter in a view.year action."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "28755",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/28755"
            },
            {
              "name": "http://bugreport.ir/index.php?/34",
              "refsource": "MISC",
              "url": "http://bugreport.ir/index.php?/34"
            },
            {
              "name": "cpcommerce-calendar-xss(41780)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41780"
            },
            {
              "name": "ADV-2008-1213",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/1213/references"
            },
            {
              "name": "29807",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/29807"
            },
            {
              "name": "5437",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/5437"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-1906",
    "datePublished": "2008-04-21T23:00:00",
    "dateReserved": "2008-04-21T00:00:00",
    "dateUpdated": "2024-08-07T08:40:59.233Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2008-1908 (GCVE-0-2008-1908)

Vulnerability from nvd – Published: 2008-04-21 23:00 – Updated: 2024-08-07 08:40
VLAI?
Summary
Multiple directory traversal vulnerabilities in cpCommerce 1.1.0 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the language parameter in a language action to the default URI, which is not properly handled in actions/language.act.php, or (2) the action parameter to category.php.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://www.securityfocus.com/bid/28755 vdb-entryx_refsource_BID
http://bugreport.ir/index.php?/34 x_refsource_MISC
http://www.vupen.com/english/advisories/2008/1213… vdb-entryx_refsource_VUPEN
http://secunia.com/advisories/29807 third-party-advisoryx_refsource_SECUNIA
https://www.exploit-db.com/exploits/5437 exploitx_refsource_EXPLOIT-DB
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T08:40:59.759Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "28755",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/28755"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://bugreport.ir/index.php?/34"
          },
          {
            "name": "ADV-2008-1213",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/1213/references"
          },
          {
            "name": "29807",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/29807"
          },
          {
            "name": "5437",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/5437"
          },
          {
            "name": "cpcommerce-multiple-file-include(41783)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41783"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-04-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple directory traversal vulnerabilities in cpCommerce 1.1.0 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the language parameter in a language action to the default URI, which is not properly handled in actions/language.act.php, or (2) the action parameter to category.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "28755",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/28755"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://bugreport.ir/index.php?/34"
        },
        {
          "name": "ADV-2008-1213",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/1213/references"
        },
        {
          "name": "29807",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/29807"
        },
        {
          "name": "5437",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/5437"
        },
        {
          "name": "cpcommerce-multiple-file-include(41783)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41783"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-1908",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple directory traversal vulnerabilities in cpCommerce 1.1.0 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the language parameter in a language action to the default URI, which is not properly handled in actions/language.act.php, or (2) the action parameter to category.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "28755",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/28755"
            },
            {
              "name": "http://bugreport.ir/index.php?/34",
              "refsource": "MISC",
              "url": "http://bugreport.ir/index.php?/34"
            },
            {
              "name": "ADV-2008-1213",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/1213/references"
            },
            {
              "name": "29807",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/29807"
            },
            {
              "name": "5437",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/5437"
            },
            {
              "name": "cpcommerce-multiple-file-include(41783)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41783"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-1908",
    "datePublished": "2008-04-21T23:00:00",
    "dateReserved": "2008-04-21T00:00:00",
    "dateUpdated": "2024-08-07T08:40:59.759Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2008-1907 (GCVE-0-2008-1907)

Vulnerability from nvd – Published: 2008-04-21 23:00 – Updated: 2024-08-07 08:40
VLAI?
Summary
Multiple SQL injection vulnerabilities in functions/display_page.func.php in cpCommerce 1.1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id_product, (2) id_manufacturer, and (3) id_category parameters to unspecified components. NOTE: this probably overlaps CVE-2007-2959 and CVE-2007-2890.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://www.securityfocus.com/bid/28755 vdb-entryx_refsource_BID
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://bugreport.ir/index.php?/34 x_refsource_MISC
http://secunia.com/advisories/29807 third-party-advisoryx_refsource_SECUNIA
https://www.exploit-db.com/exploits/5437 exploitx_refsource_EXPLOIT-DB
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T08:40:59.243Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "28755",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/28755"
          },
          {
            "name": "cpcommerce-index-sql-injection(41781)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41781"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://bugreport.ir/index.php?/34"
          },
          {
            "name": "29807",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/29807"
          },
          {
            "name": "5437",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/5437"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-04-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple SQL injection vulnerabilities in functions/display_page.func.php in cpCommerce 1.1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id_product, (2) id_manufacturer, and (3) id_category parameters to unspecified components.  NOTE: this probably overlaps CVE-2007-2959 and CVE-2007-2890."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "28755",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/28755"
        },
        {
          "name": "cpcommerce-index-sql-injection(41781)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41781"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://bugreport.ir/index.php?/34"
        },
        {
          "name": "29807",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/29807"
        },
        {
          "name": "5437",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/5437"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-1907",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple SQL injection vulnerabilities in functions/display_page.func.php in cpCommerce 1.1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id_product, (2) id_manufacturer, and (3) id_category parameters to unspecified components.  NOTE: this probably overlaps CVE-2007-2959 and CVE-2007-2890."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "28755",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/28755"
            },
            {
              "name": "cpcommerce-index-sql-injection(41781)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41781"
            },
            {
              "name": "http://bugreport.ir/index.php?/34",
              "refsource": "MISC",
              "url": "http://bugreport.ir/index.php?/34"
            },
            {
              "name": "29807",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/29807"
            },
            {
              "name": "5437",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/5437"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-1907",
    "datePublished": "2008-04-21T23:00:00",
    "dateReserved": "2008-04-21T00:00:00",
    "dateUpdated": "2024-08-07T08:40:59.243Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2003-1500 (GCVE-0-2003-1500)

Vulnerability from nvd – Published: 2007-10-25 19:00 – Updated: 2024-08-08 02:28
VLAI?
Summary
PHP remote file inclusion vulnerability in _functions.php in cpCommerce 0.5f allows remote attackers to execute arbitrary code via the prefix parameter.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T02:28:03.622Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.securiteam.com/unixfocus/6H00E2K8KG.html"
          },
          {
            "name": "8851",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/8851"
          },
          {
            "name": "20031019 ZH2003-31SA (security advisory): file inclusion vulnerability in cpCommerce",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/341757"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://cpcommerce.org/forums/index.php?board=2%3Baction=display%3Bthreadid=864"
          },
          {
            "name": "3301",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/3301"
          },
          {
            "name": "cpCommerce-functionsphp-file-include(13457)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13457"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2003-10-19T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "PHP remote file inclusion vulnerability in _functions.php in cpCommerce 0.5f allows remote attackers to execute arbitrary code via the prefix parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.securiteam.com/unixfocus/6H00E2K8KG.html"
        },
        {
          "name": "8851",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/8851"
        },
        {
          "name": "20031019 ZH2003-31SA (security advisory): file inclusion vulnerability in cpCommerce",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/341757"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://cpcommerce.org/forums/index.php?board=2%3Baction=display%3Bthreadid=864"
        },
        {
          "name": "3301",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/3301"
        },
        {
          "name": "cpCommerce-functionsphp-file-include(13457)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13457"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2003-1500",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PHP remote file inclusion vulnerability in _functions.php in cpCommerce 0.5f allows remote attackers to execute arbitrary code via the prefix parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.securiteam.com/unixfocus/6H00E2K8KG.html",
              "refsource": "MISC",
              "url": "http://www.securiteam.com/unixfocus/6H00E2K8KG.html"
            },
            {
              "name": "8851",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/8851"
            },
            {
              "name": "20031019 ZH2003-31SA (security advisory): file inclusion vulnerability in cpCommerce",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/341757"
            },
            {
              "name": "http://cpcommerce.org/forums/index.php?board=2;action=display;threadid=864",
              "refsource": "CONFIRM",
              "url": "http://cpcommerce.org/forums/index.php?board=2;action=display;threadid=864"
            },
            {
              "name": "3301",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/3301"
            },
            {
              "name": "cpCommerce-functionsphp-file-include(13457)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13457"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2003-1500",
    "datePublished": "2007-10-25T19:00:00",
    "dateReserved": "2007-10-25T00:00:00",
    "dateUpdated": "2024-08-08T02:28:03.622Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2007-2968 (GCVE-0-2007-2968)

Vulnerability from nvd – Published: 2007-06-01 01:00 – Updated: 2024-08-07 13:57
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in register.php in cpCommerce 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the name parameter (Full Name field).
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://osvdb.org/36697 vdb-entryx_refsource_OSVDB
http://www.securityfocus.com/bid/24166 vdb-entryx_refsource_BID
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://secunia.com/advisories/25424 third-party-advisoryx_refsource_SECUNIA
http://securityreason.com/securityalert/2761 third-party-advisoryx_refsource_SREASON
http://www.securityfocus.com/archive/1/469595/100… mailing-listx_refsource_BUGTRAQ
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T13:57:54.892Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "36697",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/36697"
          },
          {
            "name": "24166",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/24166"
          },
          {
            "name": "cpcommerce-fullname-xss(34517)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34517"
          },
          {
            "name": "25424",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/25424"
          },
          {
            "name": "2761",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/2761"
          },
          {
            "name": "20070525 Vulnerability - cpCommerce - XSS",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/469595/100/0/threaded"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-05-25T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in register.php in cpCommerce 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the name parameter (Full Name field)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-16T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "36697",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/36697"
        },
        {
          "name": "24166",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/24166"
        },
        {
          "name": "cpcommerce-fullname-xss(34517)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34517"
        },
        {
          "name": "25424",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/25424"
        },
        {
          "name": "2761",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/2761"
        },
        {
          "name": "20070525 Vulnerability - cpCommerce - XSS",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/469595/100/0/threaded"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-2968",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in register.php in cpCommerce 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the name parameter (Full Name field)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "36697",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/36697"
            },
            {
              "name": "24166",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/24166"
            },
            {
              "name": "cpcommerce-fullname-xss(34517)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34517"
            },
            {
              "name": "25424",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/25424"
            },
            {
              "name": "2761",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/2761"
            },
            {
              "name": "20070525 Vulnerability - cpCommerce - XSS",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/469595/100/0/threaded"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-2968",
    "datePublished": "2007-06-01T01:00:00",
    "dateReserved": "2007-05-31T00:00:00",
    "dateUpdated": "2024-08-07T13:57:54.892Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2007-2959 (GCVE-0-2007-2959)

Vulnerability from nvd – Published: 2007-05-31 23:00 – Updated: 2024-08-07 13:57
VLAI?
Summary
SQL injection vulnerability in manufacturer.php in cpCommerce before 1.1.0 allows remote attackers to execute arbitrary SQL commands via the id_manufacturer parameter.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://osvdb.org/38042 vdb-entryx_refsource_OSVDB
http://securityreason.com/securityalert/2747 third-party-advisoryx_refsource_SREASON
http://www.securityfocus.com/bid/24223 vdb-entryx_refsource_BID
http://www.securityfocus.com/archive/1/469910/100… mailing-listx_refsource_BUGTRAQ
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T13:57:54.715Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "cpcommerce-manufacturer-sql-injection(34573)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34573"
          },
          {
            "name": "38042",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/38042"
          },
          {
            "name": "2747",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/2747"
          },
          {
            "name": "24223",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/24223"
          },
          {
            "name": "20070529 cpcommerce \u003c v1.1.0 [sql injection]",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/469910/100/0/threaded"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-05-29T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "SQL injection vulnerability in manufacturer.php in cpCommerce before 1.1.0 allows remote attackers to execute arbitrary SQL commands via the id_manufacturer parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-16T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "cpcommerce-manufacturer-sql-injection(34573)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34573"
        },
        {
          "name": "38042",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/38042"
        },
        {
          "name": "2747",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/2747"
        },
        {
          "name": "24223",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/24223"
        },
        {
          "name": "20070529 cpcommerce \u003c v1.1.0 [sql injection]",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/469910/100/0/threaded"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-2959",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SQL injection vulnerability in manufacturer.php in cpCommerce before 1.1.0 allows remote attackers to execute arbitrary SQL commands via the id_manufacturer parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "cpcommerce-manufacturer-sql-injection(34573)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34573"
            },
            {
              "name": "38042",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/38042"
            },
            {
              "name": "2747",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/2747"
            },
            {
              "name": "24223",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/24223"
            },
            {
              "name": "20070529 cpcommerce \u003c v1.1.0 [sql injection]",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/469910/100/0/threaded"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-2959",
    "datePublished": "2007-05-31T23:00:00",
    "dateReserved": "2007-05-31T00:00:00",
    "dateUpdated": "2024-08-07T13:57:54.715Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

FKIE_CVE-2009-1345

Vulnerability from fkie_nvd - Published: 2009-04-20 14:30 - Updated: 2025-04-09 00:30
Severity ?
Summary
SQL injection vulnerability in document.php in cpCommerce 1.2.8 allows remote attackers to execute arbitrary SQL commands via the id_document parameter.
References
cve@mitre.orghttp://www.securityfocus.com/bid/34556Exploit
cve@mitre.orghttp://www.securitytracker.com/id?1022082
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/49901
cve@mitre.orghttps://www.exploit-db.com/exploits/8455
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/34556Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1022082
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/49901
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/8455
Impacted products
Vendor Product Version
cpcommerce cpcommerce 1.2.8
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.2.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "E70369A4-FED2-42C5-A0CB-A5299B5B8AFC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL injection vulnerability in document.php in cpCommerce 1.2.8 allows remote attackers to execute arbitrary SQL commands via the id_document parameter."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyecci\u00f3n SQL en document.php de cpCommerce v1.2.8 permite a usuarios remotos ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s del par\u00e1metro id_document."
    }
  ],
  "id": "CVE-2009-1345",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-04-20T14:30:00.500",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/34556"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1022082"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49901"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.exploit-db.com/exploits/8455"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/34556"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1022082"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49901"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/8455"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2008-4637

Vulnerability from fkie_nvd - Published: 2008-10-21 18:00 - Updated: 2025-04-09 00:30
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in cpCommerce before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via unknown vectors in the advanced search feature. NOTE: this is probably a variant of CVE-2008-4121.
References
cve@mitre.orghttp://cpcommerce.cpradio.org/Vendor Advisory
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/46090
af854a3a-2127-422b-91ae-364da2661108http://cpcommerce.cpradio.org/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/46090
Impacted products
Vendor Product Version
cpcommerce cpcommerce *
cpcommerce cpcommerce 0.5f
cpcommerce cpcommerce 1.0.5
cpcommerce cpcommerce 1.0.5.1
cpcommerce cpcommerce 1.0.6
cpcommerce cpcommerce 1.0.7
cpcommerce cpcommerce 1.0.7.1
cpcommerce cpcommerce 1.0.7.2
cpcommerce cpcommerce 1.0.7.3
cpcommerce cpcommerce 1.0.7.4
cpcommerce cpcommerce 1.0.8
cpcommerce cpcommerce 1.0.9
cpcommerce cpcommerce 1.0.9a
cpcommerce cpcommerce 1.1.0
cpcommerce cpcommerce 1.2.0
cpcommerce cpcommerce 1.2.1
cpcommerce cpcommerce 1.2.2
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0BE4BD2-CD8B-4DDD-9B55-E6B81FEE4F3B",
              "versionEndIncluding": "1.2.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:0.5f:*:*:*:*:*:*:*",
              "matchCriteriaId": "C1A76E93-7DF7-439F-906B-8C1282901966",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B47692E-BF0E-405E-9F84-F98954A7A03D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB243261-AB50-46AF-B7A3-42ACF9FAC8F7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF21D39C-1BEA-4595-A869-ACC08F0AF744",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB29AF15-B8BE-4160-9FCE-11C97710F1E4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "A0A411EE-19E6-44CA-879D-0C2FCB2E1963",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.7.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "8425BFB3-5349-44C7-A378-75F2BE3820B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.7.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "013D4ED2-C532-4A1A-AF37-B21D83BEADB9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.7.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "5F8A3E39-2CCF-4DE8-BC76-1B101F7C4415",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "07FBA21A-1B1A-44FD-BC41-F95E4CD24A12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C8EE244-FD27-4184-BB8A-49293A40C479",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.9a:*:*:*:*:*:*:*",
              "matchCriteriaId": "27B52C0D-174E-4EBF-86B8-E918824E75F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "9CC2E775-D3FF-4C06-8818-DA6105D7F2FC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0BD02E75-F434-4B84-9E88-430485C023BF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E2458A0A-3018-42BE-9C9D-8670E0ADBCCF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "19CCEF08-5E94-45BE-B8AC-0FB3D63918CA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in cpCommerce before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via unknown vectors in the advanced search feature.  NOTE: this is probably a variant of CVE-2008-4121."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en cpCommerce v1.2.4, permite a atacantes remotos inyectar secuencias de comandos web y HTML de su elecci\u00f3n a trav\u00e9s de vectores desconocidos en la funci\u00f3n de b\u00fasqueda avanzada. NOTA: probablemente se trate de una variante de CVE-2008-4121."
    }
  ],
  "evaluatorSolution": "Patch Information: http://cpcommerce.cpradio.org/downloads.php",
  "id": "CVE-2008-4637",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2008-10-21T18:00:01.007",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://cpcommerce.cpradio.org/"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46090"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://cpcommerce.cpradio.org/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46090"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2008-4121

Vulnerability from fkie_nvd - Published: 2008-10-21 18:00 - Updated: 2025-04-09 00:30
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in cpCommerce before 1.2.4 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in a search.quick action to search.php and (2) the name parameter in a sendtofriend action to sendtofriend.php.
References
cve@mitre.orghttp://cpcommerce.cpradio.org/Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/32353Vendor Advisory
cve@mitre.orghttp://securityreason.com/securityalert/4448
cve@mitre.orghttp://www.datensalat.eu/~fabian/cve/CVE-2008-4121-cpcommerce.htmlExploit
cve@mitre.orghttp://www.securityfocus.com/archive/1/497545/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/31825
cve@mitre.orghttp://www.securitytracker.com/id?1021070
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/45970
af854a3a-2127-422b-91ae-364da2661108http://cpcommerce.cpradio.org/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/32353Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/4448
af854a3a-2127-422b-91ae-364da2661108http://www.datensalat.eu/~fabian/cve/CVE-2008-4121-cpcommerce.htmlExploit
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/497545/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/31825
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1021070
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/45970
Impacted products
Vendor Product Version
cpcommerce cpcommerce *
cpcommerce cpcommerce 0.5f
cpcommerce cpcommerce 1.0.5
cpcommerce cpcommerce 1.0.5.1
cpcommerce cpcommerce 1.0.6
cpcommerce cpcommerce 1.0.7
cpcommerce cpcommerce 1.0.7.1
cpcommerce cpcommerce 1.0.7.2
cpcommerce cpcommerce 1.0.7.3
cpcommerce cpcommerce 1.0.7.4
cpcommerce cpcommerce 1.0.8
cpcommerce cpcommerce 1.0.9
cpcommerce cpcommerce 1.0.9a
cpcommerce cpcommerce 1.1.0
cpcommerce cpcommerce 1.2.0
cpcommerce cpcommerce 1.2.1
cpcommerce cpcommerce 1.2.2
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0BE4BD2-CD8B-4DDD-9B55-E6B81FEE4F3B",
              "versionEndIncluding": "1.2.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:0.5f:*:*:*:*:*:*:*",
              "matchCriteriaId": "C1A76E93-7DF7-439F-906B-8C1282901966",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B47692E-BF0E-405E-9F84-F98954A7A03D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB243261-AB50-46AF-B7A3-42ACF9FAC8F7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF21D39C-1BEA-4595-A869-ACC08F0AF744",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB29AF15-B8BE-4160-9FCE-11C97710F1E4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "A0A411EE-19E6-44CA-879D-0C2FCB2E1963",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.7.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "8425BFB3-5349-44C7-A378-75F2BE3820B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.7.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "013D4ED2-C532-4A1A-AF37-B21D83BEADB9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.7.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "5F8A3E39-2CCF-4DE8-BC76-1B101F7C4415",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "07FBA21A-1B1A-44FD-BC41-F95E4CD24A12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C8EE244-FD27-4184-BB8A-49293A40C479",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.9a:*:*:*:*:*:*:*",
              "matchCriteriaId": "27B52C0D-174E-4EBF-86B8-E918824E75F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "9CC2E775-D3FF-4C06-8818-DA6105D7F2FC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0BD02E75-F434-4B84-9E88-430485C023BF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E2458A0A-3018-42BE-9C9D-8670E0ADBCCF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "19CCEF08-5E94-45BE-B8AC-0FB3D63918CA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in cpCommerce before 1.2.4 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in a search.quick action to search.php and (2) the name parameter in a sendtofriend action to sendtofriend.php."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en cpCommerce en versiones anteriores a 1.2.4 que permite a los atacantes remotos, inyectar arbitrariamente una secuencia de comandos web o HTML a trav\u00e9s del (1) par\u00e1metro search en una acci\u00f3n search.quick para el archivo search.php y (2) el par\u00e1metro name en una acci\u00f3n sendtofriend para el archivo sendtofriend.php"
    }
  ],
  "evaluatorSolution": "Patch Information: http://cpcommerce.cpradio.org/downloads.php",
  "id": "CVE-2008-4121",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2008-10-21T18:00:00.990",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://cpcommerce.cpradio.org/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/32353"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/4448"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.datensalat.eu/~fabian/cve/CVE-2008-4121-cpcommerce.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/497545/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/31825"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1021070"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45970"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://cpcommerce.cpradio.org/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/32353"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/4448"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.datensalat.eu/~fabian/cve/CVE-2008-4121-cpcommerce.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/497545/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/31825"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1021070"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45970"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2008-1908

Vulnerability from fkie_nvd - Published: 2008-04-22 04:41 - Updated: 2025-04-09 00:30
Severity ?
Summary
Multiple directory traversal vulnerabilities in cpCommerce 1.1.0 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the language parameter in a language action to the default URI, which is not properly handled in actions/language.act.php, or (2) the action parameter to category.php.
References
cve@mitre.orghttp://bugreport.ir/index.php?/34Exploit
cve@mitre.orghttp://secunia.com/advisories/29807
cve@mitre.orghttp://www.securityfocus.com/bid/28755Exploit
cve@mitre.orghttp://www.vupen.com/english/advisories/2008/1213/references
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/41783
cve@mitre.orghttps://www.exploit-db.com/exploits/5437
af854a3a-2127-422b-91ae-364da2661108http://bugreport.ir/index.php?/34Exploit
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/29807
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/28755Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2008/1213/references
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/41783
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/5437
Impacted products
Vendor Product Version
cpcommerce cpcommerce 1.1.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "9CC2E775-D3FF-4C06-8818-DA6105D7F2FC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple directory traversal vulnerabilities in cpCommerce 1.1.0 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the language parameter in a language action to the default URI, which is not properly handled in actions/language.act.php, or (2) the action parameter to category.php."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de salto de directorio en cpCommerce 1.1.0 permiten a atacantes remotos incluir y ejecutar ficheros locales de su elecci\u00f3n a trav\u00e9s de .. (punto punto) en (1) el par\u00e1metro language en una acci\u00f3n language de una URL por defecto, lo cual no es manejado correctamente en actions/language.act.php, o (2)el par\u00e1metro action de category.php."
    }
  ],
  "id": "CVE-2008-1908",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2008-04-22T04:41:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://bugreport.ir/index.php?/34"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/29807"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/28755"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2008/1213/references"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41783"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.exploit-db.com/exploits/5437"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://bugreport.ir/index.php?/34"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/29807"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/28755"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2008/1213/references"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41783"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/5437"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2008-1906

Vulnerability from fkie_nvd - Published: 2008-04-22 04:41 - Updated: 2025-04-09 00:30
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in calendar.php in cpCommerce 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the year parameter in a view.year action.
References
cve@mitre.orghttp://bugreport.ir/index.php?/34Exploit
cve@mitre.orghttp://secunia.com/advisories/29807
cve@mitre.orghttp://www.securityfocus.com/bid/28755Exploit
cve@mitre.orghttp://www.vupen.com/english/advisories/2008/1213/references
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/41780
cve@mitre.orghttps://www.exploit-db.com/exploits/5437
af854a3a-2127-422b-91ae-364da2661108http://bugreport.ir/index.php?/34Exploit
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/29807
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/28755Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2008/1213/references
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/41780
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/5437
Impacted products
Vendor Product Version
cpcommerce cpcommerce 1.1.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "9CC2E775-D3FF-4C06-8818-DA6105D7F2FC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in calendar.php in cpCommerce 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the year parameter in a view.year action."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en calendar.php de cpCommerce 1.1.0 permite a atacantes remotos inyectar web script o HTML de su elecci\u00f3n a trav\u00e9s del par\u00e1metro year en una acci\u00f3n view.year."
    }
  ],
  "id": "CVE-2008-1906",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2008-04-22T04:41:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://bugreport.ir/index.php?/34"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/29807"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/28755"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2008/1213/references"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41780"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.exploit-db.com/exploits/5437"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://bugreport.ir/index.php?/34"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/29807"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/28755"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2008/1213/references"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41780"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/5437"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2008-1907

Vulnerability from fkie_nvd - Published: 2008-04-22 04:41 - Updated: 2025-04-09 00:30
Severity ?
Summary
Multiple SQL injection vulnerabilities in functions/display_page.func.php in cpCommerce 1.1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id_product, (2) id_manufacturer, and (3) id_category parameters to unspecified components. NOTE: this probably overlaps CVE-2007-2959 and CVE-2007-2890.
References
cve@mitre.orghttp://bugreport.ir/index.php?/34Exploit
cve@mitre.orghttp://secunia.com/advisories/29807
cve@mitre.orghttp://www.securityfocus.com/bid/28755Exploit
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/41781
cve@mitre.orghttps://www.exploit-db.com/exploits/5437
af854a3a-2127-422b-91ae-364da2661108http://bugreport.ir/index.php?/34Exploit
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/29807
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/28755Exploit
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/41781
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/5437
Impacted products
Vendor Product Version
cpcommerce cpcommerce 1.1.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "9CC2E775-D3FF-4C06-8818-DA6105D7F2FC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple SQL injection vulnerabilities in functions/display_page.func.php in cpCommerce 1.1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id_product, (2) id_manufacturer, and (3) id_category parameters to unspecified components.  NOTE: this probably overlaps CVE-2007-2959 and CVE-2007-2890."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en functions/display_page.func.php de cpCommerce 1.1.0 permiten a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s de los par\u00e1metros de componentes no especificados (1) id_product, (2) id_manufacturer, y (3) id_category.\r\nNOTA: esto probablemente se solape con CVE-2007-2959 y CVE-2007-2890."
    }
  ],
  "id": "CVE-2008-1907",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2008-04-22T04:41:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://bugreport.ir/index.php?/34"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/29807"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/28755"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41781"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.exploit-db.com/exploits/5437"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://bugreport.ir/index.php?/34"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/29807"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/28755"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41781"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/5437"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2007-2968

Vulnerability from fkie_nvd - Published: 2007-06-01 01:30 - Updated: 2025-04-09 00:30
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in register.php in cpCommerce 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the name parameter (Full Name field).
References
cve@mitre.orghttp://osvdb.org/36697
cve@mitre.orghttp://secunia.com/advisories/25424Vendor Advisory
cve@mitre.orghttp://securityreason.com/securityalert/2761
cve@mitre.orghttp://www.securityfocus.com/archive/1/469595/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/24166
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/34517
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/36697
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/25424Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/2761
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/469595/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/24166
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/34517
Impacted products
Vendor Product Version
cpcommerce cpcommerce *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C9D59305-714F-4CEB-A533-EEAC04CB9B33",
              "versionEndIncluding": "1.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in register.php in cpCommerce 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the name parameter (Full Name field)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el register.php del cpCommerce 1.1.0 y versiones anteriores permite a atacantes remotos la inyecci\u00f3n de secuencias de comandos web o HTML de su elecci\u00f3n mediante el par\u00e1metro name (campo de Nombre Completo - Full Name-)."
    }
  ],
  "id": "CVE-2007-2968",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2007-06-01T01:30:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/36697"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/25424"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/2761"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/469595/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/24166"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34517"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/36697"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/25424"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/2761"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/469595/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/24166"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34517"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2007-2959

Vulnerability from fkie_nvd - Published: 2007-05-31 23:30 - Updated: 2025-04-09 00:30
Severity ?
Summary
SQL injection vulnerability in manufacturer.php in cpCommerce before 1.1.0 allows remote attackers to execute arbitrary SQL commands via the id_manufacturer parameter.
References
cve@mitre.orghttp://osvdb.org/38042
cve@mitre.orghttp://securityreason.com/securityalert/2747
cve@mitre.orghttp://www.securityfocus.com/archive/1/469910/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/24223Exploit
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/34573
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/38042
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/2747
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/469910/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/24223Exploit
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/34573
Impacted products
Vendor Product Version
cpcommerce cpcommerce 1.0.5.1
cpcommerce cpcommerce 1.0.6
cpcommerce cpcommerce 1.0.7
cpcommerce cpcommerce 1.0.7.1
cpcommerce cpcommerce 1.0.7.2
cpcommerce cpcommerce 1.0.7.3
cpcommerce cpcommerce 1.0.7.4
cpcommerce cpcommerce 1.0.8
cpcommerce cpcommerce 1.0.9
cpcommerce cpcommerce 1.0.9a
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB243261-AB50-46AF-B7A3-42ACF9FAC8F7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF21D39C-1BEA-4595-A869-ACC08F0AF744",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB29AF15-B8BE-4160-9FCE-11C97710F1E4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "A0A411EE-19E6-44CA-879D-0C2FCB2E1963",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.7.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "8425BFB3-5349-44C7-A378-75F2BE3820B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.7.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "013D4ED2-C532-4A1A-AF37-B21D83BEADB9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.7.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "5F8A3E39-2CCF-4DE8-BC76-1B101F7C4415",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "07FBA21A-1B1A-44FD-BC41-F95E4CD24A12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C8EE244-FD27-4184-BB8A-49293A40C479",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:1.0.9a:*:*:*:*:*:*:*",
              "matchCriteriaId": "27B52C0D-174E-4EBF-86B8-E918824E75F8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL injection vulnerability in manufacturer.php in cpCommerce before 1.1.0 allows remote attackers to execute arbitrary SQL commands via the id_manufacturer parameter."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyecci\u00f3n SQL en el manufacturer.php del cpCommerce anterior al 1.1.0 permite a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s del par\u00e1metro id_manufacturer."
    }
  ],
  "id": "CVE-2007-2959",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2007-05-31T23:30:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/38042"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/2747"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/469910/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/24223"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34573"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/38042"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/2747"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/469910/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/24223"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34573"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2007-2890

Vulnerability from fkie_nvd - Published: 2007-05-30 01:30 - Updated: 2025-04-09 00:30
Severity ?
Summary
SQL injection vulnerability in category.php in cpCommerce 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id_category parameter.
References
cve@mitre.orghttp://osvdb.org/36315
cve@mitre.orghttp://secunia.com/advisories/25412
cve@mitre.orghttp://www.securityfocus.com/bid/24138Exploit
cve@mitre.orghttp://www.vupen.com/english/advisories/2007/1956
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/34484
cve@mitre.orghttps://www.exploit-db.com/exploits/3981
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/36315
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/25412
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/24138Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2007/1956
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/34484
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/3981
Impacted products
Vendor Product Version
cpcommerce cpcommerce *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cpcommerce:cpcommerce:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C9D59305-714F-4CEB-A533-EEAC04CB9B33",
              "versionEndIncluding": "1.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL injection vulnerability in category.php in cpCommerce 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id_category parameter."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyecci\u00f3n SQL en category.php en cpCommerce 1.1.0 y anteriores permite a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s del par\u00e1metro id_category."
    }
  ],
  "id": "CVE-2007-2890",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2007-05-30T01:30:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/36315"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/25412"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/24138"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2007/1956"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34484"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.exploit-db.com/exploits/3981"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/36315"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/25412"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/24138"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2007/1956"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34484"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/3981"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}