CVE-2021-3291 - CVE House
Back to Database
Status published High CVE-2021-3291

Zen Cart 1.5.7b allows admins to execute arbitrary OS commands...

Vulnerability Description

Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-3291

Credits & Attribution

No credits recorded in the NVD database.

References

More from zen-cart

View All →
CVE-2020-6578
Zen Cart 1.5.6d allows reflected XSS via the main_page parameter...
Medium 6.1
CVE-2017-8833
Zen Cart 1.6.0 has XSS in the main_page parameter to...
Medium 6.1
CVE-2017-11675
The traverseStrictSanitize function in admin_dir/includes/classes/AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key...
High 8.8
CVE-2017-10667
In index.php in Zen Cart 1.6.0, the products_id parameter can...
Medium 6.1
CVE-2015-8352
Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers...
Critical 9.8

Affected Vendor

Affected Software

zen cart
Vulnerable Versions:
1.5.7b

Timeline

Official Publish: January 26th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.