CVE-2005-2138

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in index.php in Comdev eCommerce 3.0 and 3.1 allows remote attackers to inject arbitrary web script or HTML via Javascript in the onMouseOver event of an "A" tag in a review message.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://k.domaindlx.com/shellcore/advisories.asp?bug_report=display&infamous_group=64Exploit, Vendor Advisory
http://secunia.com/advisories/15865Vendor Advisory
http://k.domaindlx.com/shellcore/advisories.asp?bug_report=display&infamous_group=64Exploit, Vendor Advisory
http://secunia.com/advisories/15865Vendor Advisory

Timeline

Published: Jul 5, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-21395.0PHP remote file inclusion vulnerability in user_check.php for Pavsta Auto Site allows remote attackers to execute arbitrary PHP code via the CVE-2005-21405.0Directory traversal vulnerability in default.asp for FSboard 2.0 allows remote attackers to read arbitrary files via ".." sequences in the f CVE-2005-21415.0TCP Chat 1.0 allows remote attackers to cause a denial of service (crash) via a long string to the chat service, possibly triggering a buffe CVE-2005-21422.1Directory traversal vulnerability in Golden FTP Server 2.60 allows remote authenticated attackers to list arbitrary directories via a "\.." CVE-2005-21435.0Microsoft Front Page allows attackers to cause a denial of service (crash) via a crafted style tag in a web page.CVE-2005-21442.1Prevx Pro 2005 1.0 allows local users to bypass file protection and modify files by using MapViewOfFile to perform memory mapping on the fil CVE-2005-21454.6The kernel driver in Prevx Pro 2005 1.0 does not verify the source of certain messages, which allows local users to bypass protection by sen CVE-2005-21464.6SSH Tectia Server 4.3.1 and earlier, and SSH Secure Shell for Windows Servers, uses insecure permissions when generating the Secure Shell ho CVE-2005-21476.4Trac before 0.8.4 allows remote attackers to read or upload arbitrary files via a full pathname in the id parameter to the (1) upload or (2)CVE-2005-21487.5Cacti 0.8.6e and earlier does not perform proper input validation to protect against common attacks, which allows remote attackers to execut CVE-2005-214910.0config.php in Cacti 0.8.6e and earlier allows remote attackers to set the no_http_headers switch, then modify session information to gain pr CVE-2005-21505.0Windows NT 4.0 and Windows 2000 before URP1 for Windows 2000 SP4 does not properly prevent NULL sessions from accessing certain alternate na