CVE-2008-6304: Xt-Commerce

Medium severity, CVSS 6.8. EPSS: 1.3% chance of exploitation in the next 30 days.

SQL injection vulnerability in xt:Commerce before 3.0.4 Sp2.1, when magic_quotes_gpc is enabled and the SEO URLs are activated, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Affected products

• Xt-Commerce Xt-Commerce: before 3.0.4 (fixed in 3.0.4); version 3.0.4 only

Published 2009-02-26. Last modified 2026-06-16.