CVE-2006-0245

Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.7-pl1 allow remote attackers to inject arbitrary web script or HTML via the (3) redir, (4) productId, (5) docId, (6) act, and (7) catId parameters in index.php; and the (8) username field in a login action in index.php. NOTE: the cart.php/redir and index.php/searchStr vectors are already covered by CVE-2005-3152.

• http://bugs.cubecart.com/?do=details&id=459Exploit, Vendor Advisory
• http://lostmon.blogspot.com/2006/01/cubecart-307-pl1-indexphp-multiple.htmlExploit, Vendor Advisory
• http://secunia.com/advisories/18519Exploit, Vendor Advisory
• http://www.osvdb.org/22471
• http://www.securityfocus.com/bid/16259Exploit
• http://www.vupen.com/english/advisories/2006/0227
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24177
• http://bugs.cubecart.com/?do=details&id=459Exploit, Vendor Advisory
• http://lostmon.blogspot.com/2006/01/cubecart-307-pl1-indexphp-multiple.htmlExploit, Vendor Advisory
• http://secunia.com/advisories/18519Exploit, Vendor Advisory
• http://www.osvdb.org/22471
• http://www.securityfocus.com/bid/16259Exploit
• http://www.vupen.com/english/advisories/2006/0227
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24177

Published

Jan 18, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-0239Multiple cross-site scripting (XSS) vulnerabilities in Simpl…
• CVE-2006-0240Multiple SQL injection vulnerabilities in Simple Blog 2.1 al…
• CVE-2006-0241Cross-site scripting vulnerability in WBNews 1.1.0 and earli…
• CVE-2006-0242Cross-site scripting vulnerability in index.php in PHP Fuseb…
• CVE-2006-0243Cross-site scripting (XSS) vulnerability in SMBCMS 2.1 allow…
• CVE-2006-0244Directory traversal vulnerability in workspaces.php in phpXp…
• CVE-2006-0246Cross-site scripting (XSS) vulnerability in down.pl in Widex…
• CVE-2006-0247Cross-site scripting (XSS) vulnerability in anyboard.cgi in …
• CVE-2006-0248Virata-EmWeb web server 6_1_0, as used in (1) Intracom JetSp…
• CVE-2006-0249SQL injection vulnerability in viewcat.php in BitDamaged geo…
• CVE-2006-0250Format string vulnerability in the snmp_input function in sn…
• CVE-2006-0251Cross-site scripting (XSS) vulnerability in fom.cgi in Faq-O…