cpcommerce is a FOSS php-based e-commerce (shopping cart) web application. Exploit: Javascript placed inside a user's "Full Name:" field will not be stripped - it will be added to the database 'as-is' as long as it has no quotations in the string. When the admin goes to the clients view page, the javascript is executed as the rogue client's name appears. Gravity: The attacker can potentially fetch the admin's cookie or do a vast amount of other things. Complication: This is very trivial to reproduce. Anyone with experience coding javascript can presently take advantage of the admin account of any unpatched cpcommerce shopping cart. This is only one aspect of this cross-site scripting vulnerability. I still have yet to test other parts of my site which have user-inputted information such as product reviews and order forms. I tested this with 1.1.0 (the latest version) - the OS is debian etch running apache2, php5 and mysql5. I suspect that earlier versions of cpcommerce are most likely also vulnerable.