Lucene search
HistorySep 25, 2006 - 1:07 a.m.
CVE-2006-4967
cve-2006-4967
cross-site scripting
xss
nextage cart
security vulnerabilities
injection
web script
html
remote code execution
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
6 Medium
AI Score
Confidence
High
0.052 Low
EPSS
Percentile
93.0%
Multiple cross-site scripting (XSS) vulnerabilities in NextAge Cart allow remote attackers to inject arbitrary web script or HTML via (1) the CatId parameter in a product category action in index.php or (2) the SearchWd parameter in an index search action in index.php.
Affected configurations
Node
nextagenextage_shopping_cart
| CPE | Name | Operator | Version |
|---|---|---|---|
| nextage:nextage_shopping_cart | nextage nextage shopping cart | eq | * |
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
6 Medium
AI Score
Confidence
High
0.052 Low
EPSS
Percentile
93.0%
Related for CVE-2006-4967