CVE-2006-5190

CVE-2006-5190 is a medium-severity vulnerability in Oscommerce with a CVSS 2.0 base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

• Severity: Medium (CVSS 2.0 base score 4.3)
• EPSS exploit prediction: 7% (93rd percentile)
• Actively exploited: Not listed in CISA KEV
• Affected product: Oscommerce
• Published: 2006-10-10
• Last modified: 2026-06-16

Description

Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in the (a) banner_manager.php, (b) banner_statistics.php, (c) countries.php, (d) currencies.php, (e) languages.php, (f) manufacturers.php, (g) newsletters.php, (h) orders_status.php, (i) products_attributes.php, (j) products_expected.php, (k) reviews.php, (l) specials.php, (m) stats_products_purchased.php, (n) stats_products_viewed.php, (o) tax_classes.php, (p) tax_rates.php, or (q) zones.php scripts in /admin, and the (2) zpage parameter in (r) admin/geo_zones.php.

Frequently asked questions

What is CVE-2006-5190?

Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in the (a) banner_manager.php, (b) banner_statistics.php, (c) countries.php, (d) currencies.php, (e) languages.php, (f) manufacturers.php, (g) newsletters.php, (h) orders_status.php, (i) products_attributes.php, (j) products_expected.php, (k) reviews.php, (l) specials.php, (m) stats_products_purchased.php, (n) stats_products_viewed.php, (o) tax_classes.php, (p) tax_rates.php, or (q) zones.php scripts in /admin, and the (2) zpage parameter in (r) admin/geo_zones.php.

How severe is CVE-2006-5190?

CVE-2006-5190 has a CVSS 2.0 base score of 4.3, rated medium severity.

Is CVE-2006-5190 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 7% (93rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2006-5190?

CVE-2006-5190 primarily affects Oscommerce. In total, 11 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2006-5190?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2006-5190 published?

CVE-2006-5190 was published on 2006-10-10 and last updated on 2026-06-16.

References

• http://lostmon.blogspot.com/2006/10/oscommerce-multiple-scripts-page-param.html
• http://secunia.com/advisories/22275
• http://securitytracker.com/id?1016979
• http://www.osvdb.org/29795
• http://www.osvdb.org/29796
• http://www.osvdb.org/29797
• http://www.osvdb.org/29798
• http://www.osvdb.org/29799
• http://www.osvdb.org/29800
• http://www.osvdb.org/29801
• http://www.osvdb.org/29802
• http://www.osvdb.org/29803
• http://www.osvdb.org/29804
• http://www.osvdb.org/29805
• http://www.osvdb.org/29806
• http://www.osvdb.org/29807
• http://www.osvdb.org/29808
• http://www.osvdb.org/29809
• http://www.osvdb.org/29810
• http://www.osvdb.org/29811
• http://www.securityfocus.com/bid/20343
• http://www.vupen.com/english/advisories/2006/3917
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29355
• https://www.exploit-db.com/exploits/28743/
• https://www.exploit-db.com/exploits/28744/
• https://www.exploit-db.com/exploits/28745/
• https://www.exploit-db.com/exploits/28746/
• https://www.exploit-db.com/exploits/28747/
• https://www.exploit-db.com/exploits/28748/
• https://www.exploit-db.com/exploits/28749/

Affected products (11)

• cpe:2.3:a:oscommerce:oscommerce:*:*:*:*:*:*:*:*
• cpe:2.3:a:oscommerce:oscommerce:1.1:*:*:*:*:*:*:*
• cpe:2.3:a:oscommerce:oscommerce:1.5.1:*:*:*:*:*:*:*
• cpe:2.3:a:oscommerce:oscommerce:1.11:*:*:*:*:*:*:*
• cpe:2.3:a:oscommerce:oscommerce:1.12:*:*:*:*:*:*:*
• cpe:2.3:a:oscommerce:oscommerce:1.13:*:*:*:*:*:*:*
• cpe:2.3:a:oscommerce:oscommerce:2.1:*:*:*:*:*:*:*
• cpe:2.3:a:oscommerce:oscommerce:2.2_cvs:*:*:*:*:*:*:*
• cpe:2.3:a:oscommerce:oscommerce:2.2_ms1:*:*:*:*:*:*:*
• cpe:2.3:a:oscommerce:oscommerce:2.2_ms2:*:*:*:*:*:*:*
• cpe:2.3:a:oscommerce:oscommerce:2.2_ms3:*:*:*:*:*:*:*

More vulnerabilities in Oscommerce

• CVE-2020-23360 — Critical (CVSS 9.8): oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical…
• CVE-2020-27976 — Critical (CVSS 9.8): osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter…
• CVE-2020-27975 — High (CVSS 8.8): osCommerce Phoenix CE before 1.0.5.4 allows admin/define_language.php CSRF.
• CVE-2019-25497 — High (CVSS 8.2): osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database…
• CVE-2019-25496 — High (CVSS 8.2): osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database…
• CVE-2019-25495 — High (CVSS 8.2): osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database…

All CVEs affecting Oscommerce →