Multiple cross-site request forgery (CSRF) vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that (1) delete a product via a deleteproductconfirm action to product.php or (2) disable a product via a setflag action to categories.php.

Multiple cross-site scripting (XSS) vulnerabilities in includes/templates/templatedefault/common/tplheadertestinfo.php in Zen Cart 1.3.9h, when debugging is enabled, might allow remote attackers to inject arbitrary web script or HTML via the (1) mainpage parameter or (2) PATHINFO, a different vulnerability than CVE-2011-4567.