CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2CVE-2006-6534
https://notcve.org/view.php?id=CVE-2006-6534
Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 3.0a3 allow remote attackers to inject arbitrary web script or HTML via the (1) set parameter to admin/modules.php, the (2) selected_box parameter to definitiva/admin/customers.php, the (3) lID parameter to admin/languages_definitions.php, or the (4) pID parameter to admin/products.php. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en osCommerce 3.0a3 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante el (1) parámetro set a admin/modules.php, el (2) parámetro selected_box a definitiva/admin/customers.php, el (3) parámetro lID a admin/languages_definitions.php, o el (4) parámetro pID a admin/products.php. • http://lostmon.blogspot.com/2006/12/oscommerce-traversal-arbitrary-file.html http://securitytracker.com/id?1017353 http://www.securityfocus.com/bid/21477 •
CVSS: 4.3EPSS: 3%CPEs: 11EXPL: 21CVE-2006-5190 – osCommerce 2.2 - '/admin/banner_manager.php?page' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2006-5190
Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in the (a) banner_manager.php, (b) banner_statistics.php, (c) countries.php, (d) currencies.php, (e) languages.php, (f) manufacturers.php, (g) newsletters.php, (h) orders_status.php, (i) products_attributes.php, (j) products_expected.php, (k) reviews.php, (l) specials.php, (m) stats_products_purchased.php, (n) stats_products_viewed.php, (o) tax_classes.php, (p) tax_rates.php, or (q) zones.php scripts in /admin, and the (2) zpage parameter in (r) admin/geo_zones.php. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados en osCommerce 2.2 Milestone 2 Update 060817 permite a un atacante remoto inyectar secuencias de comandos web o HTML de su elección a través del parámetro (1) page en las secuencias de comandos (a) banner_manager.php, (b) banner_statistics.php, (c) countries.php, (d) currencies.php, (e) languages.php, (f) manufacturers.php, (g) newsletters.php, (h) orders_status.php, (i) products_attributes.php, (j) products_expected.php, (k) reviews.php, (l) specials.php, (m) stats_products_purchased.php, (n) stats_products_viewed.php, (o) tax_classes.php, (p) tax_rates.php, o (q) zones.php en /admin, y el (2) parámetro zpage en (r) admin/geo_zones.php. • https://www.exploit-db.com/exploits/28743 https://www.exploit-db.com/exploits/28745 https://www.exploit-db.com/exploits/28746 https://www.exploit-db.com/exploits/28744 https://www.exploit-db.com/exploits/28747 https://www.exploit-db.com/exploits/28748 https://www.exploit-db.com/exploits/28749 https://www.exploit-db.com/exploits/28750 https://www.exploit-db.com/exploits/28751 https://www.exploit-db.com/exploits/28752 https://www.exploit-db.com/exploits/28753 •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 1CVE-2006-4298
https://notcve.org/view.php?id=CVE-2006-4298
Multiple directory traversal vulnerabilities in cache.php in osCommerce before 2.2 Milestone 2 060817 allow remote attackers to determine existence of arbitrary files and disclose the installation path via a .. (dot dot) in unspecified parameters in the (1) tep_cache_also_purchased, (2) tep_cache_manufacturers_box, and (3) tep_cache_categories_box functions. Múltiples vulnerabilidades de escalado de directorio en cache.php de osCommerce anterior a 2.2 Milestone 2 060817 permiten a atacantes remotos determinar la existencia de archivos de su elección y descubrir la ruta de instalación mediante un .. (punto punto) en parámetros no especificados en las funciones (1) tep_cache_also_purchased, (2) tep_cache_manufacturers_box, y (3) tep_cache_categories_box. • http://forums.oscommerce.com/index.php?showtopic=223556&pid=918371 http://www.gulftech.org/?node=research&article_id=00110-08172006 https://exchange.xforce.ibmcloud.com/vulnerabilities/28435 •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 1CVE-2006-4297
https://notcve.org/view.php?id=CVE-2006-4297
SQL injection vulnerability in shopping_cart.php in osCommerce before 2.2 Milestone 2 060817 allows remote attackers to execute arbitrary SQL commands via id array parameters. Vulnerabilidad e inyección SQL en shopping_carg.php de osCommerce anetrior a 2.2 Milestone 2 060817 permite a atacantes remotos ejecutar comandos SQL de su elección a través de parámetros array de id. • http://forums.oscommerce.com/index.php?showtopic=223556&pid=918371 http://securitytracker.com/id?1016719 http://www.gulftech.org/?node=research&article_id=00110-08172006 http://www.securityfocus.com/archive/1/444780/100/0/threaded http://www.securityfocus.com/bid/19644 http://www.securityfocus.com/bid/19774 https://exchange.xforce.ibmcloud.com/vulnerabilities/28434 •
CVSS: 7.5EPSS: 1%CPEs: 4EXPL: 0CVE-2005-4677
https://notcve.org/view.php?id=CVE-2005-4677
SQL injection vulnerability in additional_images.php (aka the Additional Images module) before 1.14 in osCommerce allows remote attackers to execute arbitrary SQL commands via the products_id parameter to product_info.php. • http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0124.html http://secunia.com/advisories/17082 http://www.oscommerce.com/community/contributions%2C1032 http://www.osvdb.org/19874 http://www.securityfocus.com/bid/15023 http://www.vupen.com/english/advisories/2005/1974 https://exchange.xforce.ibmcloud.com/vulnerabilities/22528 •