CVE-2005-3996: Zen-Cart Zen Cart

Medium severity, CVSS 5.1. EPSS: 1.9% chance of exploitation in the next 30 days.

SQL injection vulnerability in admin/password_forgotten.php in Zen Cart 1.2.6d and earlier allows remote attackers to execute arbitrary SQL commands via the admin_email parameter.

Affected products

• Zen-Cart Zen Cart: up to and including 1.2.6d

Published 2005-12-05. Last modified 2026-06-16.