CVE-2005-3997

Zen Cart 1.2.6d and earlier, under certain PHP configurations, allows remote attackers to obtain sensitive information via direct requests to files in the…

published December 5, 2005

CVSS
—
EPSS
2%
Percentile
80.3
In the wild
Unconfirmed
What it is

Zen Cart 1.2.6d and earlier, under certain PHP configurations, allows remote attackers to obtain sensitive information via direct requests to files in the admin/includes directory, including (1) graphs/banner_daily.php, (2) graphs/banner_infobox.php, (3) graphs/banner_yearly.php, (4) graphs/banner_monthly.php, (5) application_bottom.php, (6) attributes_preview.php, (7) modules/category_product_listing.php, (8) modules/copy_to_confirm.php, (9) modules/delete_product_confirm.php, and (10) modules/move_product_confirm.php, which leaks the web server path in the resulting error message.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01976 · 80.3th percentile
Published
2005-12-05T00:00Z
EPSS history
Timeline
  • 05 DEC 00:00Z
    Zen Cart 1.2.6d and earlier, under certain PHP configurations, allows remote attackers to obtain sensitive information via direct requests to files in the…
    cvelistv5