CVE-2006-5190: XSS
Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in the (a) bannermanager.php, (b) bannerstatistics.php, (c) countries.php, (d) currencies.php, (e) languages.php, (f) manufacturers.php, (g) newsletters.php, (h) ordersstatus.php, (i) productsattributes.php, (j) productsexpected.php, (k) reviews.php, (l) specials.php, (m) statsproductspurchased.php, (n) statsproductsviewed.php, (o) taxclasses.php, (p) taxrates.php, or (q) zones.php scripts in /admin, and the (2) zpage parameter in (r) admin/geozones.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-5190?
CVE-2006-5190 is classified as a high severity vulnerability due to its potential for Cross-Site Scripting attacks.
How do I fix CVE-2006-5190?
To fix CVE-2006-5190, upgrade to a version of osCommerce that is not affected or implement input validation to sanitize user input.
What types of vulnerabilities are present in CVE-2006-5190?
CVE-2006-5190 contains multiple Cross-Site Scripting (XSS) vulnerabilities.
Which versions of osCommerce are affected by CVE-2006-5190?
CVE-2006-5190 affects osCommerce versions up to 2.2 Milestone 2 Update 060817.
Can remote attackers exploit CVE-2006-5190?
Yes, remote attackers can exploit CVE-2006-5190 to inject arbitrary web scripts or HTML.