CVE-2010-3421: Cross-site scripting (XSS) vulnerability in AffiliateLogin.asp in ProductCart 3, 4.1 SP1, and possibly othe...

Security readout for executives and security teams

This is an old cross-site scripting issue in ProductCart affiliate login pages. A remote attacker could use the redirectUrl parameter to make the site return attacker-supplied script or HTML. The main business risk is customer or affiliate trust damage, phishing, and session compromise if a vulnerable legacy storefront is still exposed. Exposure is most likely on legacy internet-facing ProductCart installations with AffiliateLogin.asp enabled. The affected product list is incomplete in the CVE data, so version confirmation requires local inventory and vendor documentation. Prioritize this if legacy ProductCart remains public-facing, especially for ecommerce or affiliate workflows. If no deployment exists, close as not applicable. If confirmed, remediation should be scheduled promptly because old web XSS issues are often easy to probe. Mitigation focus: Inventory any ProductCart deployments and confirm exact versions.; Check ProductCart vendor guidance or support channels for fixed releases.; Upgrade, replace, or retire affected legacy ProductCart builds where possible..

Prepared

Jun 28, 2026, 01:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.