Alegrocart vulnerabilities

CVE-2010-1611 [MEDIUM] CWE-352 CVE-2010-1611: Cross-site request forgery (CSRF) vulnerability in AlegroCart 1.1 allows remote attackers to hijack Cross-site request forgery (CSRF) vulnerability in AlegroCart 1.1 allows remote attackers to hijack the authentication of the administrator for requests that reset the administrator password via a POST to admin/ with an update action.

CVE-2015-9226 [HIGH] CWE-89 CVE-2015-9226: Multiple SQL injection vulnerabilities in AlegroCart 1.2.8 allow remote administrators to execute ar Multiple SQL injection vulnerabilities in AlegroCart 1.2.8 allow remote administrators to execute arbitrary SQL commands via the download parameter in the (1) check_download and possibly (2) check_filename function in upload/admin2/model/products/model_admin_download.php or remote authenticated users with a valid Paypal transaction token to execute arbit

CVE-2015-9227 [HIGH] CWE-94 CVE-2015-9227: PHP remote file inclusion vulnerability in the get_file function in upload/admin2/controller/report_ PHP remote file inclusion vulnerability in the get_file function in upload/admin2/controller/report_logs.php in AlegroCart 1.2.8 allows remote administrators to execute arbitrary PHP code via a URL in the file_path parameter to upload/admin2.

CVE-2011-3701 [MEDIUM] CWE-200 CVE-2011-3701: AlegroCart 1.2.3 allows remote attackers to obtain sensitive information via a direct request to a . AlegroCart 1.2.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by common.php and certain other files.