CVE-2006-5190: oscommerce

EPSS trend

Probability

7.05%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

0.00 pp

From 7.05% on 20-09-2026

20-09-202620-10-2026

EPSS score

7.05%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

21 found

referenceUnverified
Exploit Reference (secunia.com)
Maturity: unknown
referenceUnverified
Exploit Reference (lostmon.blogspot.com)
Maturity: unknown
referenceUnverified
Exploit Reference (securitytracker.com)
Maturity: unknown

Show all 21 exploits

referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown
exploit-databasephpVerified
osCommerce 2.2 - '/admin/banner_manager.php?page' Cross-Site Scripting
Maturity: poc
exploit-databasephpVerified
osCommerce 2.2 - '/admin/banner_statistics.php?page' Cross-Site Scripting
Maturity: poc
exploit-databasephpVerified
osCommerce 2.2 - '/admin/countries.php?page' Cross-Site Scripting
Maturity: poc
exploit-databasephpVerified
osCommerce 2.2 - '/admin/currencies.php?page' Cross-Site Scripting
Maturity: poc
exploit-databasephpVerified
osCommerce 2.2 - '/admin/languages.php?page' Cross-Site Scripting
Maturity: poc
exploit-databasephpVerified
osCommerce 2.2 - '/admin/manufacturers.php?page' Cross-Site Scripting
Maturity: poc
exploit-databasephpVerified
osCommerce 2.2 - '/admin/newsletters.php?page' Cross-Site Scripting
Maturity: poc
exploit-databasephpVerified
osCommerce 2.2 - '/admin/orders_status.php?page' Cross-Site Scripting
Maturity: poc
exploit-databasephpVerified
osCommerce 2.2 - '/admin/products_attributes.php?page' Cross-Site Scripting
Maturity: poc
exploit-databasephpVerified
osCommerce 2.2 - '/admin/products_expected.php?page' Cross-Site Scripting
Maturity: poc
exploit-databasephpVerified
osCommerce 2.2 - '/admin/reviews.php?page' Cross-Site Scripting
Maturity: poc
exploit-databasephpVerified
osCommerce 2.2 - '/admin/specials.php?page' Cross-Site Scripting
Maturity: poc
exploit-databasephpVerified
osCommerce 2.2 - '/admin/stats_products_purchased.php?page' Cross-Site Scripting
Maturity: poc
exploit-databasephpVerified
osCommerce 2.2 - '/admin/stats_products_viewed.php?page' Cross-Site Scripting
Maturity: poc
exploit-databasephpVerified
osCommerce 2.2 - '/admin/tax_classes.php?page' Cross-Site Scripting
Maturity: poc
exploit-databasephpVerified
osCommerce 2.2 - '/admin/tax_rates.php?page' Cross-Site Scripting
Maturity: poc
exploit-databasephpVerified
osCommerce 2.2 - '/admin/zones.php?page' Cross-Site Scripting
Maturity: poc

References

39 links

www.exploit-db.com/exploits/28750/ExploitX Refsource EXPLOIT DB
www.osvdb.org/29801VDB EntryX Refsource OSVDB
www.exploit-db.com/exploits/28746/ExploitX Refsource EXPLOIT DB
www.osvdb.org/29803VDB EntryX Refsource OSVDB
www.vupen.com/english/advisories/2006/3917VDB EntryX Refsource VUPEN
www.osvdb.org/29798VDB EntryX Refsource OSVDB
www.osvdb.org/29808VDB EntryX Refsource OSVDB
www.osvdb.org/29807VDB EntryX Refsource OSVDB
secunia.com/advisories/22275Third Party AdvisoryX Refsource SECUNIAExploitVendor Advisory
www.osvdb.org/29802VDB EntryX Refsource OSVDB

Show all 39 references

www.osvdb.org/29795VDB EntryX Refsource OSVDB
www.exploit-db.com/exploits/28759/ExploitX Refsource EXPLOIT DB
www.exploit-db.com/exploits/28755/ExploitX Refsource EXPLOIT DB
lostmon.blogspot.com/2006/10/oscommerce-multiple-scripts-page-param.htmlX Refsource MISCExploit
www.exploit-db.com/exploits/28747/ExploitX Refsource EXPLOIT DB
www.exploit-db.com/exploits/28744/ExploitX Refsource EXPLOIT DB
securitytracker.com/id?1016979VDB EntryX Refsource SECTRACKExploit
www.osvdb.org/29809VDB EntryX Refsource OSVDB
www.osvdb.org/29799VDB EntryX Refsource OSVDB
www.exploit-db.com/exploits/28757/ExploitX Refsource EXPLOIT DB
www.exploit-db.com/exploits/28748/ExploitX Refsource EXPLOIT DB
www.osvdb.org/29810VDB EntryX Refsource OSVDB
www.osvdb.org/29811VDB EntryX Refsource OSVDB
www.exploit-db.com/exploits/28758/ExploitX Refsource EXPLOIT DB
www.exploit-db.com/exploits/28753/ExploitX Refsource EXPLOIT DB
www.osvdb.org/29797VDB EntryX Refsource OSVDB
www.osvdb.org/29806VDB EntryX Refsource OSVDB
www.exploit-db.com/exploits/28749/ExploitX Refsource EXPLOIT DB
www.osvdb.org/29800VDB EntryX Refsource OSVDB
www.securityfocus.com/bid/20343VDB EntryX Refsource BIDExploit
exchange.xforce.ibmcloud.com/vulnerabilities/29355VDB EntryX Refsource XF
www.osvdb.org/29796VDB EntryX Refsource OSVDB
www.exploit-db.com/exploits/28743/ExploitX Refsource EXPLOIT DB
www.exploit-db.com/exploits/28754/ExploitX Refsource EXPLOIT DB
www.exploit-db.com/exploits/28745/ExploitX Refsource EXPLOIT DB
www.osvdb.org/29804VDB EntryX Refsource OSVDB
www.exploit-db.com/exploits/28756/ExploitX Refsource EXPLOIT DB
www.osvdb.org/29805VDB EntryX Refsource OSVDB
www.exploit-db.com/exploits/28752/ExploitX Refsource EXPLOIT DB

Related vulnerabilities

CVE-2018-18573oscommerceoscommerce2.61%7y ago22-08-2019 14:34osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated administrators can upload new '.htaccess' files (e.g., omitting .php) and subsequently achieve arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=new_product URI.CVE-2018-18572oscommerceoscommerce2.59%7y ago22-08-2019 14:33osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter, script files with certain PHP-related extensions (such as .phtml and .php5) didn't execute in the application. But this filter didn't prevent the '.pht' extension. Thus, remote authenticated administrators can upload '.pht' files for arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=new_product URI.CVE-2003-1219oscommerceoscommerce3.32%21y ago04-08-2005 04:00Cross-site scripting (XSS) vulnerability in the tep_href_link function in html_output.php for osCommerce before 2.2-MS3 allows remote attackers to inject arbitrary web script or HTML via the osCsid parameter.CVE-2015-2965oscommerceoscommerce1.97%11y ago28-06-2015 19:00Directory traversal vulnerability in osCommerce Japanese 2.2ms1j-R8 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors.CVE-2025-40674oscommerceoscommerce0.49%1y ago17-06-2025 08:50Reflected Cross-Site Scripting (XSS) in osCommerce v4. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the name of any parameter in /watch/en/about-us. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.CVE-2020-29070oscommerceoscommerce1.16%5y ago25-11-2020 19:05osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters.

All vulnerabilities inoscommerce

CVE-2006-5190: oscommerce

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References