Read the docs
TI-2006-05006 Aliases CVE-2006-5190GHSA-q9c2-hcj4-555h

Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update…

Priority LOW 30Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in the (a) banner_manager.php, (b) banner_statistics.php, (c) countries.php, (d) currencies.php, (e) languages.php, (f) manufacturers.php, (g) newsletters.php, (h) orders_status.php, (i) products_attributes.php, (j) products_expected.php, (k) reviews.php, (l) specials.php, (m) stats_products_purchased.php, (n) stats_products_viewed.php, (o) tax_classes.php, (p) tax_rates.php, or (q) zones.php scripts in /admin, and the (2) zpage parameter in (r) admin/geo_zones.php.

Why it matters now

EPSS 0.07177 94th percentileScored 2026-11-07
Public exploit Yes 17 exploit referencesTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:oscommerce:oscommerce:*:*:*:*:*:*:*:*up to 2.2_ms2_2006-08-17VulnerableOs Commerce
cpe:2.3:a:oscommerce:oscommerce:1.1:*:*:*:*:*:*:*1.1VulnerableOs Commerce
cpe:2.3:a:oscommerce:oscommerce:1.5.1:*:*:*:*:*:*:*1.5.1VulnerableOs Commerce
cpe:2.3:a:oscommerce:oscommerce:1.11:*:*:*:*:*:*:*1.11VulnerableOs Commerce
cpe:2.3:a:oscommerce:oscommerce:1.12:*:*:*:*:*:*:*1.12VulnerableOs Commerce
cpe:2.3:a:oscommerce:oscommerce:1.13:*:*:*:*:*:*:*1.13VulnerableOs Commerce
cpe:2.3:a:oscommerce:oscommerce:2.1:*:*:*:*:*:*:*2.1VulnerableOs Commerce
cpe:2.3:a:oscommerce:oscommerce:2.2_cvs:*:*:*:*:*:*:*2.2_cvsVulnerableOs Commerce
cpe:2.3:a:oscommerce:oscommerce:2.2_ms1:*:*:*:*:*:*:*2.2_ms1VulnerableOs Commerce
cpe:2.3:a:oscommerce:oscommerce:2.2_ms2:*:*:*:*:*:*:*2.2_ms2VulnerableOs Commerce
  • cpe:2.3:a:oscommerce:oscommerce:*:*:*:*:*:*:*:* Versions up to 2.2_ms2_2006-08-17 Vulnerable ·Os Commerce
  • cpe:2.3:a:oscommerce:oscommerce:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Os Commerce
  • cpe:2.3:a:oscommerce:oscommerce:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·Os Commerce
  • cpe:2.3:a:oscommerce:oscommerce:1.11:*:*:*:*:*:*:* Versions 1.11 Vulnerable ·Os Commerce
  • cpe:2.3:a:oscommerce:oscommerce:1.12:*:*:*:*:*:*:* Versions 1.12 Vulnerable ·Os Commerce
  • cpe:2.3:a:oscommerce:oscommerce:1.13:*:*:*:*:*:*:* Versions 1.13 Vulnerable ·Os Commerce
  • cpe:2.3:a:oscommerce:oscommerce:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Os Commerce
  • cpe:2.3:a:oscommerce:oscommerce:2.2_cvs:*:*:*:*:*:*:* Versions 2.2_cvs Vulnerable ·Os Commerce
  • cpe:2.3:a:oscommerce:oscommerce:2.2_ms1:*:*:*:*:*:*:* Versions 2.2_ms1 Vulnerable ·Os Commerce
  • cpe:2.3:a:oscommerce:oscommerce:2.2_ms2:*:*:*:*:*:*:* Versions 2.2_ms2 Vulnerable ·Os Commerce
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oscommerce:oscommerce:2.2_ms3:*:*:*:*:*:*:*2.2_ms3VulnerableOs Commerce
  • cpe:2.3:a:oscommerce:oscommerce:2.2_ms3:*:*:*:*:*:*:* Versions 2.2_ms3 Vulnerable ·Os Commerce

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2006-5190
  2. 2026-10-03 Alias added: GHSA-q9c2-hcj4-555h

References

Exploit 17

Other 18

  • TI-2019-15550 osCommerce 2.3.4.1 SQL Injection via currency Parameter CVSS 4.0HIGH 8.8
  • TI-2019-15549 osCommerce 2.3.4.1 SQL Injection via products_id Parameter CVSS 4.0HIGH 8.8
  • TI-2019-15548 osCommerce 2.3.4.1 SQL Injection via reviews_id Parameter CVSS 4.0HIGH 8.8
  • TI-2023-06030 osCommerce POST Parameter shopping-cart sql injection CVSS 3.1CRITICAL 9.8
  • TI-2023-23428 Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) CVSS 3.1MEDIUM 5.4
  • TI-2023-23427 Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) CVSS 3.1MEDIUM 5.4
See all 77 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences