CVE-2010-4631

Multiple cross-site scripting (XSS) vulnerabilities in ASPilot Pilot Cart 7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) countrycode parameter to contact.asp, USERNAME parameter to (2) gateway.asp and (3) cart.asp, and the specific parameter to (4) quote.asp and (5) buyitnow.

• CWE-79

• http://advisories.ariko-security.com/november/audyt_bezpieczenstwa_745.htmlExploit
• http://marc.info/?l=full-disclosure&m=128913521908405&w=2Exploit
• http://packetstormsecurity.org/1011-exploits/aspilotpilotcart-sqlxssinject.txt
• http://secunia.com/advisories/30176Vendor Advisory
• http://www.exploit-db.com/exploits/15448Exploit
• http://www.securityfocus.com/bid/44698Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/63053
• http://advisories.ariko-security.com/november/audyt_bezpieczenstwa_745.htmlExploit
• http://marc.info/?l=full-disclosure&m=128913521908405&w=2Exploit
• http://packetstormsecurity.org/1011-exploits/aspilotpilotcart-sqlxssinject.txt
• http://secunia.com/advisories/30176Vendor Advisory
• http://www.exploit-db.com/exploits/15448Exploit
• http://www.securityfocus.com/bid/44698Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/63053

Published

Dec 30, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-4625MyBB (aka MyBulletinBoard) before 1.4.12 does not properly h…
• CVE-2010-4626The my_rand function in functions.php in MyBB (aka MyBulleti…
• CVE-2010-4627Cross-site request forgery (CSRF) vulnerability in usercp2.p…
• CVE-2010-4628member.php in MyBB (aka MyBulletinBoard) before 1.4.12 makes…
• CVE-2010-4629MyBB (aka MyBulletinBoard) before 1.4.12 does not properly r…
• CVE-2010-4630Cross-site scripting (XSS) vulnerability in pages/admin/surv…
• CVE-2010-4632Multiple SQL injection vulnerabilities in ASPilot Pilot Cart…
• CVE-2010-4633SQL injection vulnerability in cart.php in digiSHOP 2.0.2 al…
• CVE-2010-4634Directory traversal vulnerability in osTicket 1.6 allows rem…
• CVE-2010-4635SQL injection vulnerability in detail.asp in Site2Nite Vacat…
• CVE-2010-4636SQL injection vulnerability in detail.asp in Site2Nite Busin…
• CVE-2010-4637Cross-site scripting (XSS) vulnerability in feedlist/handler…