CVE-2021-3291
Zen Cart vulnerable to authenticated remote code execution
Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.
- Record
CVE-2021-3291- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Weakness
- CWE-78
- Updated
- 2026-11-02
CVE List No score
Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.
- Record
CVE-2021-3291- Updated
- 2026-11-02
EUVDEUVD-2022-2136 No score
Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.
- Record
EUVD-2022-2136- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-38f9-4vhq-9cr8
Zen Cart vulnerable to authenticated remote code execution
Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.
- Record
GHSA-38f9-4vhq-9cr8- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSV
Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.
- Record
CVE-2021-3291- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-38f9-4vhq-9cr8
Zen Cart vulnerable to authenticated remote code execution
Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.
- Record
GHSA-38f9-4vhq-9cr8- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zencart/zencartPackagist |
through 1.5.7b | 1.5.7c |
zencart/zencartPackagist |
before 1.5.7c, plus listed versions v1.5.6v1.5.6av1.5.6bv1.5.6b-2019-05-27 |
1.5.7c |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Zen Cart 1.5.7b - Remote Code Execution (Authenticated) | 2021-03-02 |
| PoC in GitHub | ImHades101/CVE-2021-3291 | 2021-04-25 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-3291 is a high vulnerability (CVSS 7.2) in Zen-cart Zen Cart, published January 26, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 17.0%, the 97th percentile. Fixed in zencart/zencart 1.5.7c.
References
github.com/MucahitSaratar/zencart_auth_rce_poc
packetstormsecurity.com/files/161613/Zen-Cart-1.5.7b-Remote-Code-Execution.html
nvd.nist.gov/vuln/detail/CVE-2021-3291