Zen Cart is a niche, open-source e-commerce platform used to power small-to-medium online shopping applications. Its vulnerability profile centers on a single product and recurs through web-application weaknesses characteristic of server-side PHP shopping carts: path traversal, authentication flaws, code injection, and cross-site scripting, reflecting common challenges in handling user input and session management across a public-facing storefront. These weakness classes are typical of application-layer vulnerabilities in customer-facing commerce systems and represent the core attack surface of the platform. Defenders running Zen Cart instances should prioritize input validation and access-control controls; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Zen Cart over time
Signals from CVEs in this vendor scope (42 CVEs).
42 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-5762HIGH Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installation | Aug 21, 2024 | 8.1 | 62 | NO | NO |
CVE-2015-8352CRITICAL Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act parameter to ajax.php. | Aug 24, 2017 | 9.8 | 49 | NO | YES |
CVE-2009-2255MEDIUM Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which allows remote attackers to execute arbitrary code by uploadin | Jun 30, 2009 | 6.8 | 46 | NO | YES |
CVE-2021-3291HIGH Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command. | Jan 26, 2021 | 7.2 | 42 | NO | YES |
CVE-2009-2254HIGH Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows remote attackers to execute arbitrary SQL commands via the q | Jun 30, 2009 | 7.5 | 33 | NO | YES |
CVE-2011-4403MEDIUM Multiple cross-site request forgery (CSRF) vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that (1) delete a p | Apr 24, 2015 | 5.8 | 29 | NO | YES |
CVE-2008-6615HIGH SQL injection vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to execute arbitrary SQL commands via the keyword parameter in the advanced_search_re | Apr 6, 2009 | 7.5 | 28 | NO | YES |
CVE-2017-11675HIGH The traverseStrictSanitize function in admin_dir/includes/classes/AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which allows remote authenticated users to exe | Jul 27, 2017 | 8.8 | 26 | NO | NO |
CVE-2008-6985MEDIUM Multiple SQL injection vulnerabilities in includes/classes/shopping_cart.php in Zen Cart 1.2.0 through 1.3.8a, when magic_quotes_gpc is disabled, allow remote attackers to execute | Aug 19, 2009 | 6.8 | 26 | NO | YES |
CVE-2006-0697HIGH Zen Cart before 1.2.7 does not protect the admin/includes directory, which allows remote attackers to cause unknown impact via unspecified vectors, probably direct requests. | Feb 15, 2006 | 10.0 | 26 | NO | NO |
Signals from CVEs in this vendor scope (42 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Zen Cart.
Media articles that mention a CVE ID that affects a product developed by Zen Cart — matched by CVE ID, not by vendor name.