GCVE - cpe:2.3:a:cs-cart:cs-cart:1.3.3:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:cs-cart:cs-cart:1.3.3:*:*:*:*:*:*:*

part: a version: 1.3.3 update: *

Vendor	Cs Cart (`8eacec83-fd2e-57be-9862-caefae47e2ee`)
Product	Cs Cart (`db19b04b-4853-5e75-a476-7496e0e70ed7`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/cscart/docs`	purl2cpe	2026-06-01 10:18:04.855798

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-7317`	vulnerable	2026-06-08 05:05:09.707659	Details available Multiple cross-site scripting (XSS) vulnerabilities in CS-Cart before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) settings_file or (2) data_file parameter to (a) ampie.swf, (b) amline.swf, or (c) amcolumn.swf. Published: 2014-01-24T15:00:00.000Z Updated: 2024-09-17T02:32:17.527Z Open on db.gcve.eu Reference links http://www.kb.cert.org/vuls/id/405942	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-2579`	vulnerable	2026-06-08 04:51:29.252125	Details available SQL injection vulnerability in reward_points.post.php in the Reward points addon in CS-Cart before 2.0.6 allows remote authenticated users to execute arbitrary SQL commands via the sort_order parameter in a reward_points.userlog action to index.php, a different vulnerability than CVE-2005-4429.2. Published: 2009-08-05T19:00:00.000Z Updated: 2024-08-07T05:59:55.625Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/35936 http://secunia.com/advisories/36112 http://www.securityfocus.com/archive/1/505492/100/0/threaded http://www.bonsai-sec.com/research/vulnerabilities/cs-cart_SQL-injection-0100.txt http://www.cs-cart.com/changelog206.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-6394`	vulnerable	2026-06-08 04:50:54.989754	Details available SQL injection vulnerability in core/user.php in CS-Cart 1.3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the cs_cookies[customer_user_id] cookie parameter. Published: 2009-03-04T17:00:00.000Z Updated: 2024-08-07T11:27:35.827Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/6352 http://secunia.com/advisories/31686 http://www.gulftech.org/?node=research&article_id=00128-09022008 http://www.securityfocus.com/archive/1/495907/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/44852	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-0230`	vulnerable	2026-06-08 04:49:31.729578	Details available PHP remote file inclusion vulnerability in install.php in CS-Cart 1.3.3 allows remote attackers to execute arbitrary PHP code via a URL in the install_dir parameter. NOTE: CVE and third parties dispute this vulnerability because install_dir is defined before use Published: 2007-01-13T02:00:00.000Z Updated: 2024-08-07T12:12:17.471Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/31408 http://osvdb.org/31277 http://www.securityfocus.com/archive/1/456527/100/0/threaded http://www.attrition.org/pipermail/vim/2007-January/001223.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.