CVE Tools

cpcommerce

Web & CMS Pluginscommercial

9

Cumulative CVEs

5

Monthly snapshots

#29

Peak rank

Top products

Latest CVEs

The 10 most recently published vulnerabilities affecting cpcommerce.

CVE-2009-1345SQL injection vulnerability in document.php in cpCommerce 1.2.8 allows remote attackers to execute arbitrary SQL commands via the id_document parameter.7.5Apr 20, 2009
CVE-2008-4637Cross-site scripting (XSS) vulnerability in cpCommerce before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via unknown vectors in the advanced search feature. NOTE: this is...4.3Oct 21, 2008
CVE-2008-4121Multiple cross-site scripting (XSS) vulnerabilities in cpCommerce before 1.2.4 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in a search.quick action to...4.3Oct 21, 2008
CVE-2008-1908Multiple directory traversal vulnerabilities in cpCommerce 1.1.0 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the language parameter in a language a...7.5Apr 21, 2008
CVE-2008-1906Cross-site scripting (XSS) vulnerability in calendar.php in cpCommerce 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the year parameter in a view.year action.4.3Apr 21, 2008
CVE-2008-1907Multiple SQL injection vulnerabilities in functions/display_page.func.php in cpCommerce 1.1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id_product, (2) id_manufacturer, a...7.5Apr 21, 2008
CVE-2003-1500PHP remote file inclusion vulnerability in _functions.php in cpCommerce 0.5f allows remote attackers to execute arbitrary code via the prefix parameter.6.8Oct 25, 2007
CVE-2007-2968Cross-site scripting (XSS) vulnerability in register.php in cpCommerce 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the name parameter (Full Name field).4.3Jun 1, 2007
CVE-2007-2959SQL injection vulnerability in manufacturer.php in cpCommerce before 1.1.0 allows remote attackers to execute arbitrary SQL commands via the id_manufacturer parameter.7.5May 31, 2007
CVE-2007-2890SQL injection vulnerability in category.php in cpCommerce 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id_category parameter.7.5May 30, 2007