Description

Multiple cross-site scripting (XSS) vulnerabilities in includes/templates/template_default/common/tpl_header_test_info.php in Zen Cart 1.3.9h, when debugging is enabled, might allow remote attackers to inject arbitrary web script or HTML via the (1) main_page parameter or (2) PATH_INFO, a different vulnerability than CVE-2011-4567.

Remediation

References

CVE-2011-4547

Related Vulnerabilities

Liferay Portal Permissions, Privileges, and Access Controls Vulnerability (CVE-2010-5327)

Piwigo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2009-4039)

WordPress Plugin Simple Share Buttons Adder Multiple Vulnerabilities (4.4)

WordPress Plugin Testimonial Rotator Cross-Site Scripting (3.0.3)

LimeSurvey Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2019-25019)

Severity

Medium

Classification

CVE-2011-4547 CWE-707

Tags

Missing Update Known Vulnerabilities