X-Cart 3.4.3 allows remote attackers to execute arbitrary commands via the perl_binary argument in (1) upgrade.php or (2) general.php.

Published 22 y ago 2004-03-18 · modified 4 mo ago 2026-06-16 · JSON

CVSS

10.0

v2.0 · NVD

CISA KEV

not known exploited

EPSS

6.0%

percentile 93%

Public exploits

Exploit-DB

X-Cart 3.4.3 allows remote attackers to execute arbitrary commands via the perl_binary argument in (1) upgrade.php or (2) general.php.

Exploit prediction (EPSS)

6.03% probability of exploitation in the next 30 days, higher than 93% of all scored CVEs.

EDB-23637 Qualiteam X-Cart 3.x - 'upgrade.php?perl_binary' Arbitrary Command Execution · webapps · 2004-02-03
EDB-23636 Qualiteam X-Cart 3.x - 'general.php?perl_binary' Arbitrary Command Execution · webapps · 2004-02-03

Assigned by	Version	Score	Vector
NVD	2.0	10.0	`AV:N/AC:L/Au:N/C:C/I:C/A:C`

exchange.xforce.ibmcloud.com /vulnerabilities/15034 · vdb-entry, x_refsource_XF, x_transferred
marc.info /?l=bugtraq&m=107582648326448&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
securityfocus.com /bid/9560 · vdb-entry, x_refsource_BID, x_transferred

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.