vulnwire
6.8med

CVE-2005-14406 exploits

Multiple cross-site scripting (XSS) vulnerabilities in ViArt Shop Enterprise 2.1.6 allow remote attackers to inject arbitrary web script or…

Published 21 y ago · modified 4 mo ago · JSON

CVSS
6.8
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.2%
percentile 88%
Public exploits
6
Exploit-DB

Multiple cross-site scripting (XSS) vulnerabilities in ViArt Shop Enterprise 2.1.6 allow remote attackers to inject arbitrary web script or HTML via (1) various parameters to basket.php, (2) the nickname, email, topic, and message fields in forum.php, as demonstrated using forum_new_thread.php and forum_thread.php, (3) the page parameter to page.php, (4) category_id and item_id parameters to reviews.php, (5) the category_id parameter to product_details.php, (6) the category_id or search_string parameters to products.php, or (7) the rp or page parameters to news_view.php.

Exploit prediction (EPSS)

3.19% probability of exploitation in the next 30 days, higher than 88% of all scored CVEs.

Exploits and detections

  • EDB-25580 CodetoSell ViArt Shop Enterprise 2.1.6 - 'news_view.php' Multiple Cross-Site Scripting Vulnerabilities · webapps · 2005-05-02
  • EDB-25579 CodetoSell ViArt Shop Enterprise 2.1.6 - 'products.php' Multiple Cross-Site Scripting Vulnerabilities · webapps · 2005-05-02
  • EDB-25578 CodetoSell ViArt Shop Enterprise 2.1.6 - 'product_details.php?category_id' Cross-Site Scripting · webapps · 2005-05-02
  • EDB-25577 CodetoSell ViArt Shop Enterprise 2.1.6 - 'reviews.php' Multiple Cross-Site Scripting Vulnerabilities · webapps · 2005-05-02
  • EDB-25576 CodetoSell ViArt Shop Enterprise 2.1.6 - 'page.php?page' Cross-Site Scripting · webapps · 2005-05-02
  • EDB-25575 CodetoSell ViArt Shop Enterprise 2.1.6 - 'basket.php' Multiple Cross-Site Scripting Vulnerabilities · webapps · 2005-05-02

CVSS scores

Assigned byVersionScoreVector
NVD2.06.8AV:N/AC:M/Au:N/C:P/I:P/A:P

References

  • securityfocus.com /bid/13462 · vdb-entry, x_refsource_BID, x_transferred
  • osvdb.org /15958 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securitytracker.com /id?1013853 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • osvdb.org /15955 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /15953 · vdb-entry, x_refsource_OSVDB, x_transferred
  • lostmon.blogspot.com /2005/04/viart-shop-enterprise-multiple.html · x_refsource_MISC, x_transferred
  • osvdb.org /15954 · vdb-entry, x_refsource_OSVDB, x_transferred
  • secunia.com /advisories/15181 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • osvdb.org /15952 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /15957 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /15951 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /15956 · vdb-entry, x_refsource_OSVDB, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.