Description

Cross-site scripting (XSS) vulnerability in includes/templates/template_default/templates/tpl_gv_send_default.php in Zen Cart before 1.5 allows remote attackers to inject arbitrary web script or HTML via the message parameter in a gv_send action to index.php, a different vulnerability than CVE-2011-4547.

Remediation

References

CVE-2011-4567

Related Vulnerabilities

WordPress Plugin Spider Calendar Cross-Site Scripting (1.1.0)

MyBB Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-9407)

WordPress Plugin Quick Page/Post Redirect Open Redirect (5.1.5)

Drupal Core 9.2.x Directory Traversal (9.2.0 - 9.2.1)

WordPress Plugin Simply Show Hooks Malicious Code (1.2.1)

Severity

Medium

Classification

CVE-2011-4567 CWE-707

Tags

Missing Update Known Vulnerabilities