CVE-2004-2024: Zen Cart

High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days.

The distribution of Zen Cart 1.1.4 before patch 2 includes certain debugging code in the Admin password retrieval functionality, which allows attackers to gain administrative privileges via password_forgotten.php.

Affected products

• Zen Cart Zen Cart: version 1.1.4 only

Published 2004-12-31. Last modified 2026-06-16.