CVE-2007-6646

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

4.09%

Published

Jan 4, 2008

Modified

Jun 16, 2026

Public PoC / Exploit (4)

All weaponized →

Exploit-DBLiveCart 1.0.1 - 'email' Cross-Site Scripting Exploit-DBLiveCart 1.0.1 - 'q' Cross-Site Scripting Exploit-DBLiveCart 1.0.1 - 'return' Cross-Site Scripting (1)Exploit-DBLiveCart 1.0.1 - 'return' Cross-Site Scripting (2)

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Multiple cross-site scripting (XSS) vulnerabilities in LiveCart 1.0.1, and possibly other versions before 1.1.0, allow remote attackers to inject arbitrary web script or HTML via (1) the return parameter to user/remindPassword, (2) the q parameter to the category script, (3) the return parameter to the order script, or (4) the email parameter to user/remindComplete.

Weaknesses (CWE)

CWE-79

Affected Products (1)

integry_systems · livecartvulnerable

References (20)

http://archives.neohapsis.com/archives/bugtraq/2008-02/0003.html

http://livecart.com/news/Major-update-LiveCart-1-1-0.8

http://osvdb.org/39756

http://osvdb.org/39757

http://osvdb.org/39758

http://secunia.com/advisories/28017

Vendor Advisory