CVE-2006-2649

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in (a) search.php, (b) search_cat.php, (c) search_price.php, and (d) product_details.php in the cosmicshop directory for CosmicShoppingCart allow remote attackers to inject arbitrary web script or HTML via multiple unspecified parameters, as demonstrated by the (1) query parameter in search.php and the (2) data parameter in search_cat.php.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 30, 2006
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-26507.5SQL injection vulnerability in cosmicshop/search.php in CosmicShoppingCart allows remote attackers to execute arbitrary SQL commands via the CVE-2006-26512.6Cross-site scripting (XSS) vulnerability in index.php in Vacation Rental Script 1.0 allows remote attackers to inject arbitrary web script o CVE-2006-26526.8Cross-site scripting (XSS) vulnerability in WikiNi 0.4.2 and earlier allows remote attackers to inject arbitrary HTML and web script by edit CVE-2006-26532.6Cross-site scripting (XSS) vulnerability in login_error.shtml for D-Link DSA-3100 allows remote attackers to inject arbitrary HTML or web sc CVE-2006-26546.4Directory traversal vulnerability in smbfs smbfs on FreeBSD 4.10 up to 6.1 allows local users to escape chroot restrictions for an SMB-mount CVE-2006-26556.4The build process for ypserv in FreeBSD 5.3 up to 6.1 accidentally disables access restrictions when using the /var/yp/securenets file, whic CVE-2006-26567.5Stack-based buffer overflow in the tiffsplit command in libtiff 3.8.2 and earlier might might allow attackers to execute arbitrary code via CVE-2006-26585.0Directory traversal vulnerability in the xsp component in mod_mono in Mono/C# web server, as used in SUSE Open-Enterprise-Server 1 and SUSE CVE-2006-26597.8libs/comverp.c in Courier MTA before 0.53.2 allows attackers to cause a denial of service (CPU consumption) via unknown vectors involving us CVE-2006-26602.1Buffer consumption vulnerability in the tempnam function in PHP 5.1.4 and 4.x before 4.4.3 allows local users to bypass restrictions and cre CVE-2006-26615.0ftutil.c in Freetype before 2.2 allows remote attackers to cause a denial of service (crash) via a crafted font file that triggers a null de CVE-2006-26624.6VMware Server before RC1 does not clear user credentials from memory after a console connection is made, which might allow local attackers t