This patch is for ALL versions of Zen Cart up to 1.5.6B

I affects product notifications which could give access to the database and open your database up to and SQL injection by a hacker.

It contains one file that does not overwrite any core files.  You can read more about it and / or download the file to upload yourself if you have the time and capability at this Zen Cart post.