CVE-2015-2210

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into the window source to create a button that spawns a command shell.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/131732/Epicor-Retail-Store-Help-System-3.2.03.01.008-Code-Execution.htmlMitigation, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/535423/100/1000/threaded
http://packetstormsecurity.com/files/131732/Epicor-Retail-Store-Help-System-3.2.03.01.008-Code-Execution.htmlMitigation, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/535423/100/1000/threaded

Timeline

Published: Sep 6, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-22137.5SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attacke CVE-2015-22145.0NetCat 5.01 and earlier allows remote attackers to obtain the installation path via the redirect_url parameter to netshop/post.php.CVE-2015-22155.8Open redirect vulnerability in the Services single sign-on server helper (services_sso_server_helper) module for Drupal allows remote attack CVE-2015-22167.5SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to execute arbitrary SQL co CVE-2015-22174.3Multiple cross-site scripting (XSS) vulnerabilities in Ultimate PHP Board (aka myUPB) before 2.2.8 allow remote attackers to inject arbitrar CVE-2015-22184.3Multiple cross-site scripting (XSS) vulnerabilities in the wp_ajax_save_item function in wonderpluginaudio.php in the WonderPlugin Audio Pla CVE-2015-22197.2Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to ga CVE-2015-22204.3Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to injec CVE-2015-22215.0ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted y0da cryptor file.CVE-2015-22225.0ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted petite packed file.CVE-2015-22234.3Multiple cross-site scripting (XSS) vulnerabilities in the web-based console management interface in Palo Alto Networks Traps (formerly Cyve CVE-2015-22306.1Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console.