PatchTheCVEshopping cart vulnerabilities and fixes
Recent CVEs affecting shopping cart, with upgrade or downgrade steps. 21 tracked.
Also searched as: shoppingcart.
shopping cart has 21 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2009-02-03. Highest priority: CVE-2007-5364 (score 56/100).
- CVE-2000-0921 MEDIUM 5.0 UPGRADE Directory traversal vulnerability in Hassan Consulting shop.cgi shopping cart program allows remote attackers
- CVE-2000-1243 MEDIUM 5.0 DOWNGRADE Privacy leak in Dansie Shopping Cart 3.04, and probably earlier versions, sends sensitive information such as
- CVE-2009-0412 HIGH 7.5 DOWNGRADE The ProcessLogin function in class.auth.php in Interspire Shopping Cart (ISC) 4.0.1 Ultimate edition allows re
- CVE-2008-4143 HIGH 7.5 MITIGATE SQL injection vulnerability in category_search.php in RazorCommerce Shopping Cart allows remote attackers to e
- CVE-2008-1076 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in search.php in Interspire Shopping Cart 1.x allows remote attackers
- CVE-2007-5364 HIGH 10.0 MITIGATE Directory traversal vulnerability in payments/ideal_process.php in the iDEAL transaction handler in ViArt Shop
- CVE-2007-3448 MEDIUM 4.3 UPGRADE Cross-site scripting (XSS) vulnerability in index.php in BugMall Shopping Cart 2.5 and earlier allows remote a
- CVE-2007-3447 MEDIUM 6.8 DOWNGRADE SQL injection vulnerability in BugMall Shopping Cart 2.5 and earlier allows remote attackers to execute arbitr
- CVE-2007-3446 HIGH 7.5 UPGRADE BugMall Shopping Cart 2.5 and earlier has a default username "demo" and password "demo," which allows remote a
- CVE-2007-2997 HIGH 7.5 MITIGATE Multiple SQL injection vulnerabilities in cgi-bin/reorder2.asp in SalesCart Shopping Cart allow remote attacke
- CVE-2006-6691 HIGH 7.5 DOWNGRADE Multiple PHP remote file inclusion vulnerabilities in Valdersoft Shopping Cart 3.0 and earlier allow remote at
- CVE-2006-3542 MEDIUM 5.8 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in Garry Glendown Shopping Cart 0.9 allow remote attackers
- CVE-2006-0111 MEDIUM 5.0 MITIGATE Cross-site scripting vulnerability in index.php in Boxcar Media Shopping Cart allows remote attackers to injec
- CVE-2006-0109 MEDIUM 5.0 MITIGATE Cross-site scripting vulnerability in category.php in Modular Merchant Shopping Cart allows remote attackers t
- CVE-2005-4003 HIGH 7.5 DOWNGRADE Multiple SQL injection vulnerabilities in Absolute Shopping Package Solutions (ASPS) Shopping Cart Professiona
- CVE-2005-2477 MEDIUM 5.0 DOWNGRADE shop_display_products.php in Naxtor Shopping Cart 1.0 allows remote attackers to obtain sensitive information
- CVE-2005-2476 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in lost_passowrd.php in Naxtor Shopping Cart 1.0 allows remote attack
- CVE-2005-1789 HIGH 7.5 MITIGATE SQL injection vulnerability in SignIn.asp in India Software Solution shopping cart allows remote attackers to
- CVE-2005-0907 HIGH 7.5 DOWNGRADE Multiple SQL injection vulnerabilities in Valdersoft Shopping Cart 3.0 allow remote attackers to execute arbit
- CVE-2003-1517 MEDIUM 5.0 MITIGATE cart.pl in Dansie shopping cart allows remote attackers to obtain the installation path via an invalid db para
- CVE-2001-0985 HIGH 7.5 DOWNGRADE shop.pl in Hassan Consulting Shopping Cart 1.23 allows remote attackers to execute arbitrary commands via shel
FAQ
How do I fix shopping cart vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is shopping cart being exploited right now?
None of the tracked shopping cart CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which shopping cart CVE should I patch first?
CVE-2007-5364 currently ranks highest (56/100): Directory traversal vulnerability in payments/ideal_process.php in the iDEAL transaction handler in ViArt Shop.