CVE-2006-5190
published 2006-10-10CVE-2006-5190: Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers to inject arbitrary web script or HTML…
PriorityP420medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
6.49%
92.9th percentile
Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in the (a) banner_manager.php, (b) banner_statistics.php, (c) countries.php, (d) currencies.php, (e) languages.php, (f) manufacturers.php, (g) newsletters.php, (h) orders_status.php, (i) products_attributes.php, (j) products_expected.php, (k) reviews.php, (l) specials.php, (m) stats_products_purchased.php, (n) stats_products_viewed.php, (o) tax_classes.php, (p) tax_rates.php, or (q) zones.php scripts in /admin, and the (2) zpage parameter in (r) admin/geo_zones.php.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oscommerce | oscommerce | <= 2.2_ms2_2006-08-17 | — |
| oscommerce | oscommerce | — | — |
| oscommerce | oscommerce | — | — |
| oscommerce | oscommerce | — | — |
| oscommerce | oscommerce | — | — |
| oscommerce | oscommerce | — | — |
| oscommerce | oscommerce | — | — |
| oscommerce | oscommerce | — | — |
| oscommerce | oscommerce | — | — |
| oscommerce | oscommerce | — | — |
| oscommerce | oscommerce | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
osCommerce admin/zones.php page cross site scripting (EDB-28743 / XFDB-29355)
vuldb·2026-04-23·CVSS 4.3
CVE-2006-5190 [MEDIUM] osCommerce admin/zones.php page cross site scripting (EDB-28743 / XFDB-29355)
A vulnerability marked as problematic has been reported in osCommerce. This impacts an unknown function of the file admin/zones.php. Performing a manipulation of the argument page results in basic cross site scripting.
This vulnerability was named CVE-2006-5190. The attack may be initiated remotely. In addition, an exploit is available.
GHSA
GHSA-q9c2-hcj4-555h: Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2
ghsa_unreviewed·2022-05-01
CVE-2006-5190 [MEDIUM] GHSA-q9c2-hcj4-555h: Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2
Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in the (a) banner_manager.php, (b) banner_statistics.php, (c) countries.php, (d) currencies.php, (e) languages.php, (f) manufacturers.php, (g) newsletters.php, (h) orders_status.php, (i) products_attributes.php, (j) products_expected.php, (k) reviews.php, (l) specials.php, (m) stats_products_purchased.php, (n) stats_products_viewed.php, (o) tax_classes.php, (p) tax_rates.php, or (q) zones.php scripts in /admin, and the (2) zpage parameter in (r) admin/geo_zones.php.
No detection rules found.
Exploit-DB
osCommerce 2.2 - '/admin/stats_products_viewed.php?page' Cross-Site Scripting
exploitdb·2006-10-04
CVE-2006-5190 osCommerce 2.2 - '/admin/stats_products_viewed.php?page' Cross-Site Scripting
osCommerce 2.2 - '/admin/stats_products_viewed.php?page' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/20343/info
osCommerce is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
http://www.example.com/catalog/admin/stats_products_viewed.php?page=1[XSS-code]
Exploit-DB
osCommerce 2.2 - '/admin/tax_classes.php?page' Cross-Site Scripting
exploitdb·2006-10-04
CVE-2006-5190 osCommerce 2.2 - '/admin/tax_classes.php?page' Cross-Site Scripting
osCommerce 2.2 - '/admin/tax_classes.php?page' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/20343/info
osCommerce is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
http://www.example.com/catalog/admin/tax_classes.php?page=1[XSS-code]
Exploit-DB
osCommerce 2.2 - '/admin/banner_statistics.php?page' Cross-Site Scripting
exploitdb·2006-10-04
CVE-2006-5190 osCommerce 2.2 - '/admin/banner_statistics.php?page' Cross-Site Scripting
osCommerce 2.2 - '/admin/banner_statistics.php?page' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/20343/info
osCommerce is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
http://www.example.com/catalog/admin/banner_statistics.php?page=1[XSS-code]
Exploit-DB
osCommerce 2.2 - '/admin/manufacturers.php?page' Cross-Site Scripting
exploitdb·2006-10-04
CVE-2006-5190 osCommerce 2.2 - '/admin/manufacturers.php?page' Cross-Site Scripting
osCommerce 2.2 - '/admin/manufacturers.php?page' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/20343/info
osCommerce is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
http://www.example.com/catalog/admin/manufacturers.php?page=1[XSS-code]
Exploit-DB
osCommerce 2.2 - '/admin/orders_status.php?page' Cross-Site Scripting
exploitdb·2006-10-04
CVE-2006-5190 osCommerce 2.2 - '/admin/orders_status.php?page' Cross-Site Scripting
osCommerce 2.2 - '/admin/orders_status.php?page' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/20343/info
osCommerce is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
http://www.example.com/catalog/admin/orders_status.php?page=1[XSS-code]
Exploit-DB
osCommerce 2.2 - '/admin/newsletters.php?page' Cross-Site Scripting
exploitdb·2006-10-04
CVE-2006-5190 osCommerce 2.2 - '/admin/newsletters.php?page' Cross-Site Scripting
osCommerce 2.2 - '/admin/newsletters.php?page' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/20343/info
osCommerce is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
http://www.example.com/catalog/admin/newsletters.php?page=1[XSS-code]
Exploit-DB
osCommerce 2.2 - '/admin/products_expected.php?page' Cross-Site Scripting
exploitdb·2006-10-04
CVE-2006-5190 osCommerce 2.2 - '/admin/products_expected.php?page' Cross-Site Scripting
osCommerce 2.2 - '/admin/products_expected.php?page' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/20343/info
osCommerce is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
http://www.example.com/catalog/admin/products_expected.php?page=1[XSS-code]
Exploit-DB
osCommerce 2.2 - '/admin/zones.php?page' Cross-Site Scripting
exploitdb·2006-10-04
CVE-2006-5190 osCommerce 2.2 - '/admin/zones.php?page' Cross-Site Scripting
osCommerce 2.2 - '/admin/zones.php?page' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/20343/info
osCommerce is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
http://www.example.com/catalog/admin/zones.php?page=1[XSS-code]
Exploit-DB
osCommerce 2.2 - '/admin/specials.php?page' Cross-Site Scripting
exploitdb·2006-10-04
CVE-2006-5190 osCommerce 2.2 - '/admin/specials.php?page' Cross-Site Scripting
osCommerce 2.2 - '/admin/specials.php?page' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/20343/info
osCommerce is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
http://www.example.com/catalog/admin/specials.php?page=1[XSS-code]
Exploit-DB
osCommerce 2.2 - '/admin/currencies.php?page' Cross-Site Scripting
exploitdb·2006-10-04
CVE-2006-5190 osCommerce 2.2 - '/admin/currencies.php?page' Cross-Site Scripting
osCommerce 2.2 - '/admin/currencies.php?page' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/20343/info
osCommerce is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
http://www.example.com/catalog/admin/currencies.php?page=1[XSS-code]
Exploit-DB
osCommerce 2.2 - '/admin/stats_products_purchased.php?page' Cross-Site Scripting
exploitdb·2006-10-04
CVE-2006-5190 osCommerce 2.2 - '/admin/stats_products_purchased.php?page' Cross-Site Scripting
osCommerce 2.2 - '/admin/stats_products_purchased.php?page' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/20343/info
osCommerce is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
http://www.example.com/catalog/admin/stats_products_purchased.php?page=1[XSS-code]
Exploit-DB
osCommerce 2.2 - '/admin/banner_manager.php?page' Cross-Site Scripting
exploitdb·2006-10-04
CVE-2006-5190 osCommerce 2.2 - '/admin/banner_manager.php?page' Cross-Site Scripting
osCommerce 2.2 - '/admin/banner_manager.php?page' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/20343/info
osCommerce is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
http://www.example.com/catalog/admin/banner_manager.php?page=1[XSS-code]
Exploit-DB
osCommerce 2.2 - '/admin/products_attributes.php?page' Cross-Site Scripting
exploitdb·2006-10-04
CVE-2006-5190 osCommerce 2.2 - '/admin/products_attributes.php?page' Cross-Site Scripting
osCommerce 2.2 - '/admin/products_attributes.php?page' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/20343/info
osCommerce is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
http://www.example.com/catalog/admin/products_attributes.php?page=1[XSS-code]
Exploit-DB
osCommerce 2.2 - '/admin/reviews.php?page' Cross-Site Scripting
exploitdb·2006-10-04
CVE-2006-5190 osCommerce 2.2 - '/admin/reviews.php?page' Cross-Site Scripting
osCommerce 2.2 - '/admin/reviews.php?page' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/20343/info
osCommerce is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
http://www.example.com/catalog/admin/reviews.php?page=1[XSS-code]
Exploit-DB
osCommerce 2.2 - '/admin/tax_rates.php?page' Cross-Site Scripting
exploitdb·2006-10-04
CVE-2006-5190 osCommerce 2.2 - '/admin/tax_rates.php?page' Cross-Site Scripting
osCommerce 2.2 - '/admin/tax_rates.php?page' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/20343/info
osCommerce is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
http://www.example.com/catalog/admin/tax_rates.php?page=1[XSS-code]
Exploit-DB
osCommerce 2.2 - '/admin/countries.php?page' Cross-Site Scripting
exploitdb·2006-10-04
CVE-2006-5190 osCommerce 2.2 - '/admin/countries.php?page' Cross-Site Scripting
osCommerce 2.2 - '/admin/countries.php?page' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/20343/info
osCommerce is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
http://www.example.com/catalog/admin/countries.php?page=1[XSS-code]
Exploit-DB
osCommerce 2.2 - '/admin/languages.php?page' Cross-Site Scripting
exploitdb·2006-10-04
CVE-2006-5190 osCommerce 2.2 - '/admin/languages.php?page' Cross-Site Scripting
osCommerce 2.2 - '/admin/languages.php?page' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/20343/info
osCommerce is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
http://www.example.com/catalog/admin/languages.php?page=1[XSS-code]
No writeups or analysis indexed.
http://lostmon.blogspot.com/2006/10/oscommerce-multiple-scripts-page-param.htmlhttp://secunia.com/advisories/22275http://securitytracker.com/id?1016979http://www.osvdb.org/29795http://www.osvdb.org/29796http://www.osvdb.org/29797http://www.osvdb.org/29798http://www.osvdb.org/29799http://www.osvdb.org/29800http://www.osvdb.org/29801http://www.osvdb.org/29802http://www.osvdb.org/29803http://www.osvdb.org/29804http://www.osvdb.org/29805http://www.osvdb.org/29806http://www.osvdb.org/29807http://www.osvdb.org/29808http://www.osvdb.org/29809http://www.osvdb.org/29810http://www.osvdb.org/29811http://www.securityfocus.com/bid/20343http://www.vupen.com/english/advisories/2006/3917https://exchange.xforce.ibmcloud.com/vulnerabilities/29355https://www.exploit-db.com/exploits/28743/https://www.exploit-db.com/exploits/28744/https://www.exploit-db.com/exploits/28745/https://www.exploit-db.com/exploits/28746/https://www.exploit-db.com/exploits/28747/https://www.exploit-db.com/exploits/28748/https://www.exploit-db.com/exploits/28749/https://www.exploit-db.com/exploits/28750/https://www.exploit-db.com/exploits/28752/https://www.exploit-db.com/exploits/28753/https://www.exploit-db.com/exploits/28754/https://www.exploit-db.com/exploits/28755/https://www.exploit-db.com/exploits/28756/https://www.exploit-db.com/exploits/28757/https://www.exploit-db.com/exploits/28758/https://www.exploit-db.com/exploits/28759/http://lostmon.blogspot.com/2006/10/oscommerce-multiple-scripts-page-param.htmlhttp://secunia.com/advisories/22275http://securitytracker.com/id?1016979http://www.osvdb.org/29795http://www.osvdb.org/29796http://www.osvdb.org/29797http://www.osvdb.org/29798http://www.osvdb.org/29799http://www.osvdb.org/29800http://www.osvdb.org/29801http://www.osvdb.org/29802http://www.osvdb.org/29803http://www.osvdb.org/29804http://www.osvdb.org/29805http://www.osvdb.org/29806http://www.osvdb.org/29807http://www.osvdb.org/29808http://www.osvdb.org/29809http://www.osvdb.org/29810http://www.osvdb.org/29811http://www.securityfocus.com/bid/20343http://www.vupen.com/english/advisories/2006/3917https://exchange.xforce.ibmcloud.com/vulnerabilities/29355https://www.exploit-db.com/exploits/28743/https://www.exploit-db.com/exploits/28744/https://www.exploit-db.com/exploits/28745/https://www.exploit-db.com/exploits/28746/https://www.exploit-db.com/exploits/28747/https://www.exploit-db.com/exploits/28748/https://www.exploit-db.com/exploits/28749/https://www.exploit-db.com/exploits/28750/https://www.exploit-db.com/exploits/28752/https://www.exploit-db.com/exploits/28753/https://www.exploit-db.com/exploits/28754/https://www.exploit-db.com/exploits/28755/https://www.exploit-db.com/exploits/28756/https://www.exploit-db.com/exploits/28757/https://www.exploit-db.com/exploits/28758/https://www.exploit-db.com/exploits/28759/
2006-10-10
Published