CVE-2021-3291

CVE-2021-3291 is a critical authenticated remote code execution (RCE) vulnerability affecting Zen Cart version 1.5.7b, allowing administrative users to execute arbitrary OS commands through manipulation of an HTML radio input element on the modules edit page. With a CVSS score of 7.2 (HIGH), this vulnerability presents a significant risk due to its low attack complexity and complete compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, an authenticated exploit is publicly available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion or media coverage.