https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2009-0412.htmlhttps://patchthecve.com/cve/CVE-2009-0412.htmlTue, 16 Jun 2026 23:04:59 +0000HIGH 7.5: The ProcessLogin function in class.auth.php in Interspire Shopping Cart (ISC) 4.0.1 Ultimate edition allows remote attackers to bypass authentication and obtain administrative access by reusing the RememberToken cookie after a failed admin login attempt.https://patchthecve.com/cve/CVE-2008-4143.htmlhttps://patchthecve.com/cve/CVE-2008-4143.htmlTue, 16 Jun 2026 22:57:15 +0000HIGH 7.5: SQL injection vulnerability in category_search.php in RazorCommerce Shopping Cart allows remote attackers to execute arbitrary SQL commands via the id parameter.https://patchthecve.com/cve/CVE-2008-1076.htmlhttps://patchthecve.com/cve/CVE-2008-1076.htmlTue, 16 Jun 2026 22:50:56 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in search.php in Interspire Shopping Cart 1.x allows remote attackers to inject arbitrary web script or HTML via the search_query parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.https://patchthecve.com/cve/CVE-2007-5364.htmlhttps://patchthecve.com/cve/CVE-2007-5364.htmlTue, 16 Jun 2026 22:45:58 +0000HIGH 10.0: Directory traversal vulnerability in payments/ideal_process.php in the iDEAL transaction handler in ViArt Shopping Cart allows remote attackers to have an unknown impact via directory traversal sequences in the filename parameter to the createCertFingerprint function. NOTE: this issue is disputed bhttps://patchthecve.com/cve/CVE-2007-3448.htmlhttps://patchthecve.com/cve/CVE-2007-3448.htmlTue, 16 Jun 2026 22:42:03 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in index.php in BugMall Shopping Cart 2.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the msgs parameter. NOTE: 4.0.2 and other versions might also be affected.https://patchthecve.com/cve/CVE-2007-3447.htmlhttps://patchthecve.com/cve/CVE-2007-3447.htmlTue, 16 Jun 2026 22:42:03 +0000MEDIUM 6.8: SQL injection vulnerability in BugMall Shopping Cart 2.5 and earlier allows remote attackers to execute arbitrary SQL commands via the "basic search box." NOTE: 4.0.2 and other versions might also be affected.https://patchthecve.com/cve/CVE-2007-3446.htmlhttps://patchthecve.com/cve/CVE-2007-3446.htmlTue, 16 Jun 2026 22:42:03 +0000HIGH 7.5: BugMall Shopping Cart 2.5 and earlier has a default username "demo" and password "demo," which allows remote attackers to obtain login access.https://patchthecve.com/cve/CVE-2007-2997.htmlhttps://patchthecve.com/cve/CVE-2007-2997.htmlTue, 16 Jun 2026 22:40:51 +0000HIGH 7.5: Multiple SQL injection vulnerabilities in cgi-bin/reorder2.asp in SalesCart Shopping Cart allow remote attackers to execute arbitrary SQL commands via the password field and other unspecified vectors. NOTE: the vendor disputes this issue, stating "We were able to reproduce this sql injection on an ohttps://patchthecve.com/cve/CVE-2006-6691.htmlhttps://patchthecve.com/cve/CVE-2006-6691.htmlTue, 16 Jun 2026 22:33:36 +0000HIGH 7.5: Multiple PHP remote file inclusion vulnerabilities in Valdersoft Shopping Cart 3.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the commonIncludePath parameter to (1) admin/include/common.php, (2) include/common.php, or (3) common_include/common.php.https://patchthecve.com/cve/CVE-2006-3542.htmlhttps://patchthecve.com/cve/CVE-2006-3542.htmlTue, 16 Jun 2026 22:27:16 +0000MEDIUM 5.8: Multiple cross-site scripting (XSS) vulnerabilities in Garry Glendown Shopping Cart 0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) shop name field in (a) editshop.php, (b) edititem.php, and (c) index.php; and via the (2) item field in editshop.php and edititem.php.https://patchthecve.com/cve/CVE-2006-0111.htmlhttps://patchthecve.com/cve/CVE-2006-0111.htmlTue, 16 Jun 2026 22:19:54 +0000MEDIUM 5.0: Cross-site scripting vulnerability in index.php in Boxcar Media Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the (1) parent or (2) pg parameter.https://patchthecve.com/cve/CVE-2006-0109.htmlhttps://patchthecve.com/cve/CVE-2006-0109.htmlTue, 16 Jun 2026 22:19:54 +0000MEDIUM 5.0: Cross-site scripting vulnerability in category.php in Modular Merchant Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the cat parameter.https://patchthecve.com/cve/CVE-2005-4003.htmlhttps://patchthecve.com/cve/CVE-2005-4003.htmlTue, 16 Jun 2026 22:18:02 +0000HIGH 7.5: Multiple SQL injection vulnerabilities in Absolute Shopping Package Solutions (ASPS) Shopping Cart Professional 2.9d and earlier, and Lite 2.1 and earlier, allow remote attackers to execute arbitrary SQL commands via the (1) srch_product_name parameter to adv_search.asp and (2) b_search parameter tohttps://patchthecve.com/cve/CVE-2005-2477.htmlhttps://patchthecve.com/cve/CVE-2005-2477.htmlTue, 16 Jun 2026 22:14:58 +0000MEDIUM 5.0: shop_display_products.php in Naxtor Shopping Cart 1.0 allows remote attackers to obtain sensitive information via a cat_id with a "'" (single quote), which reveals the path in an error message, possibly due to an SQL injection vulnerability.https://patchthecve.com/cve/CVE-2005-2476.htmlhttps://patchthecve.com/cve/CVE-2005-2476.htmlTue, 16 Jun 2026 22:14:57 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in lost_passowrd.php in Naxtor Shopping Cart 1.0 allows remote attackers to inject arbitrary web script or HTML via the email parameter.https://patchthecve.com/cve/CVE-2005-1789.htmlhttps://patchthecve.com/cve/CVE-2005-1789.htmlTue, 16 Jun 2026 22:13:41 +0000HIGH 7.5: SQL injection vulnerability in SignIn.asp in India Software Solution shopping cart allows remote attackers to execute arbitrary SQL commands via the password.https://patchthecve.com/cve/CVE-2005-0907.htmlhttps://patchthecve.com/cve/CVE-2005-0907.htmlTue, 16 Jun 2026 22:12:01 +0000HIGH 7.5: Multiple SQL injection vulnerabilities in Valdersoft Shopping Cart 3.0 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to category.php, (2) the id parameter to item.php, (3) the lang parameter to index.php, (4) the searchQuery parameter to search_result.php, (5) or https://patchthecve.com/cve/CVE-2003-1517.htmlhttps://patchthecve.com/cve/CVE-2003-1517.htmlTue, 16 Jun 2026 22:04:34 +0000MEDIUM 5.0: cart.pl in Dansie shopping cart allows remote attackers to obtain the installation path via an invalid db parameter, which leaks the path in an error message.https://patchthecve.com/cve/CVE-2001-0985.htmlhttps://patchthecve.com/cve/CVE-2001-0985.htmlTue, 16 Jun 2026 21:55:21 +0000HIGH 7.5: shop.pl in Hassan Consulting Shopping Cart 1.23 allows remote attackers to execute arbitrary commands via shell metacharacters in the "page" parameter.https://patchthecve.com/cve/CVE-2000-1243.htmlhttps://patchthecve.com/cve/CVE-2000-1243.htmlWed, 23 Sep 2026 09:10:01 +0000MEDIUM 5.0: Privacy leak in Dansie Shopping Cart 3.04, and probably earlier versions, sends sensitive information such as user credentials to an e-mail address controlled by the product developers.https://patchthecve.com/cve/CVE-2000-0921.htmlhttps://patchthecve.com/cve/CVE-2000-0921.htmlWed, 23 Sep 2026 13:10:00 +0000MEDIUM 5.0: Directory traversal vulnerability in Hassan Consulting shop.cgi shopping cart program allows remote attackers to read arbitrary files via a .. (dot dot) attack on the page parameter.