Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers to inject arbitrary w
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 17 on Exploit-DB
Summary
Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in the (a) banner_manager.php, (b) banner_statistics.php, (c) countries.php, (d) currencies.php, (e) languages.php, (f) manufacturers.php, (g) newsletters.php, (h) orders_status.php, (i) products_attributes.php, (j) products_expected.php, (k) reviews.php, (l) specials.php, (m) stats_products_purchased.php, (n) stats_products_viewed.php, (o) tax_classes.php, (p) tax_rates.php, or (q) zones.php scripts in /admin, and the (2) zpage parameter in (r) admin/geo_zones.php.
Timeline
- Public exploit on Exploit-DB
EDB-28743, EDB-28744, EDB-28745, EDB-28746, EDB-28747, EDB-28748, EDB-28749, EDB-28750, EDB-28751, EDB-28752, EDB-28753, EDB-28754, EDB-28755, EDB-28756, EDB-28757, EDB-28758, EDB-28759
- CVE published
- Record last updated
Affected versions
- n/a n/a
Version range not reported
References 42
Exploit-DB
- Exploit EDB-28750
- Exploit EDB-28746
- Exploit EDB-28759
- Exploit EDB-28755
- Exploit EDB-28747
- Exploit EDB-28744
- Exploit EDB-28757
- Exploit EDB-28748
- Exploit EDB-28758
- Exploit EDB-28753
- Exploit EDB-28743
- Exploit EDB-28744
- Exploit EDB-28745
- Exploit EDB-28746
- Exploit EDB-28747
- Exploit EDB-28748
- Exploit EDB-28749
- Exploit EDB-28750
- Exploit EDB-28751
- Exploit EDB-28752
- Exploit EDB-28753
- Exploit EDB-28754
- Exploit EDB-28755
- Exploit EDB-28756
- Exploit EDB-28757
- Exploit EDB-28758
- Exploit EDB-28759