CVE-2021-3291: Zen-Cart Zen Cart

High severity, CVSS 7.2. EPSS: 16.8% chance of exploitation in the next 30 days.

Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.

Affected products

• Zen-Cart Zen Cart: version 1.5.7b only

Published 2021-01-26. Last modified 2026-06-17.