1.3.9

DATE	CVE	VULNERABILITY TITLE	RISK
2012-05-27	CVE-2012-1413	Cross-Site Scripting vulnerability in Zen-Cart ZEN Cart Cross-site scripting (XSS) vulnerability in zc_install/includes/modules/pages/database_setup/header_php.php in Zen Cart 1.5.0 and earlier, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the db_username parameter to zc_install/index.php. network high complexity zen-cart CWE-79	2.6
2011-11-29	CVE-2011-4567	Cross-Site Scripting vulnerability in Zen-Cart ZEN Cart Cross-site scripting (XSS) vulnerability in includes/templates/template_default/templates/tpl_gv_send_default.php in Zen Cart before 1.5 allows remote attackers to inject arbitrary web script or HTML via the message parameter in a gv_send action to index.php, a different vulnerability than CVE-2011-4547. network zen-cart CWE-79	4.3