Description

Multiple cross-site scripting (XSS) vulnerabilities in includes/templates/template_default/common/tpl_header_test_info.php in Zen Cart 1.3.9h, when debugging is enabled, might allow remote attackers to inject arbitrary web script or HTML via the (1) main_page parameter or (2) PATH_INFO, a different vulnerability than CVE-2011-4567.

Remediation

References

CVE-2011-4547

Related Vulnerabilities

Envoy Proxy Excessive Iteration Vulnerability (CVE-2021-39204)

WordPress Plugin Job Board Vanila Cross-Site Scripting (1.0)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-35651)

WordPress Plugin S3 Video Cross-Site Scripting (0.982)

Internet Information Services Other Vulnerability (CVE-1999-0191)

Severity

Medium

Classification

CVE-2011-4547 CWE-707

Tags

Missing Update Known Vulnerabilities