https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2010-3421.htmlhttps://patchthecve.com/cve/CVE-2010-3421.htmlTue, 16 Jun 2026 23:22:44 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in AffiliateLogin.asp in ProductCart 3, 4.1 SP1, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the redirectUrl parameter, a different vector than CVE-2004-2174 and CVE-2005-0995. NOTE: some of these details arehttps://patchthecve.com/cve/CVE-2005-1968.htmlhttps://patchthecve.com/cve/CVE-2005-1968.htmlTue, 16 Jun 2026 22:13:59 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in ProductCart Ecommerce before 2.7 allows remote attackers to inject arbitrary web script or HTML via the error parameter to techErr.asp.https://patchthecve.com/cve/CVE-2005-0995.htmlhttps://patchthecve.com/cve/CVE-2005-0995.htmlTue, 16 Jun 2026 22:12:11 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in ProductCart 2.7 allow remote attackers to inject arbitrary web script or HTML via (1) the keyword parameter to advSearch_h.asp, (2) the redirectUrl parameter to NewCust.asp, (3) the country parameter to storelocator_submit.asp, or (4) the error https://patchthecve.com/cve/CVE-2005-0994.htmlhttps://patchthecve.com/cve/CVE-2005-0994.htmlTue, 16 Jun 2026 22:12:11 +0000HIGH 7.5: Multiple SQL injection vulnerabilities in ProductCart 2.7 allow remote attackers to execute arbitrary SQL commands via (1) the Category or resultCnt parameters to advSearch_h.asp, and possibly (2) the offset parameter to tarinasworld_butterflyjournal.asp. NOTE: it is possible that item (2) is the rehttps://patchthecve.com/cve/CVE-2004-2174.htmlhttps://patchthecve.com/cve/CVE-2004-2174.htmlTue, 16 Jun 2026 22:09:10 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in Custva.asp in EarlyImpact ProductCart allows remote attackers to inject arbitrary Javascript via the redirectUrl parameter.https://patchthecve.com/cve/CVE-2004-2173.htmlhttps://patchthecve.com/cve/CVE-2004-2173.htmlTue, 16 Jun 2026 22:09:10 +0000HIGH 7.5: SQL injection vulnerability in advSearch_h.asp in EarlyImpact ProductCart allows remote attackers to execute arbitrary SQL commands via the priceUntil parameter.https://patchthecve.com/cve/CVE-2004-2172.htmlhttps://patchthecve.com/cve/CVE-2004-2172.htmlTue, 16 Jun 2026 22:09:09 +0000HIGH 7.5: EarlyImpact ProductCart uses a weak encryption scheme to encrypt passwords, which allows remote attackers to obtain the password via a chosen plaintext attack.https://patchthecve.com/cve/CVE-2003-1304.htmlhttps://patchthecve.com/cve/CVE-2003-1304.htmlTue, 16 Jun 2026 22:03:53 +0000MEDIUM 5.0: EarlyImpact ProductCart 1.0 through 2.0 stores database/EIPC.mdb under the web root with insufficient access control, which allows remote attackers to obtain sensitive database information via a direct request.https://patchthecve.com/cve/CVE-2003-0523.htmlhttps://patchthecve.com/cve/CVE-2003-0523.htmlTue, 16 Jun 2026 22:02:21 +0000MEDIUM 6.8: Cross-site scripting (XSS) vulnerability in msg.asp for certain versions of ProductCart allow remote attackers to execute arbitrary web script via the message parameter.https://patchthecve.com/cve/CVE-2003-0522.htmlhttps://patchthecve.com/cve/CVE-2003-0522.htmlTue, 16 Jun 2026 22:02:21 +0000HIGH 10.0: Multiple SQL injection vulnerabilities in ProductCart 1.5 through 2 allow remote attackers to (1) gain access to the admin control panel via the idadmin parameter to login.asp or (2) gain other privileges via the Email parameter to Custva.asp.