CVE-2020-6578

Zen Cart 1.5.6d allows reflected XSS via the main_page parameter to includes/templates/template_default/common/tpl_main_page.php or includes/templates/responsive_classic/common/tpl_main_page.php.

• CWE-79

• https://herolab.usd.de/security-advisories/Third Party Advisory
• https://herolab.usd.de/security-advisories/usd-2019-0069/Exploit, Third Party Advisory
• https://herolab.usd.de/security-advisories/Third Party Advisory
• https://herolab.usd.de/security-advisories/usd-2019-0069/Exploit, Third Party Advisory

Published

Mar 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-6572Use after free in Media in Google Chrome prior to 81.0.4044.…8.8
• CVE-2020-6573Use after free in video in Google Chrome on Android prior to…9.6
• CVE-2020-6574Insufficient policy enforcement in installer in Google Chrom…7.8
• CVE-2020-6575Race in Mojo in Google Chrome prior to 85.0.4183.102 allowed…8.3
• CVE-2020-6576Use after free in offscreen canvas in Google Chrome prior to…8.8
• CVE-2020-6577The IT-Recht Kanzlei plugin in Zen Cart 1.5.6c (German editi…9.8
• CVE-2020-6579Cross-site scripting (XSS) vulnerability in mailhive/cloudbe…6.1
• CVE-2020-6581Nagios NRPE 3.2.1 has Insufficient Filtering because, for ex…7.3
• CVE-2020-6582Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demon…7.5
• CVE-2020-6583BigProf Online Invoicing System (OIS) through 2.6 has XSS th…6.1
• CVE-2020-6584Nagios Log Server 2.1.3 has Incorrect Access Control.6.5
• CVE-2020-6585Nagios Log Server 2.1.3 has CSRF.8.8