CVE-2006-2649

Multiple cross-site scripting (XSS) vulnerabilities in (a) search.php, (b) search_cat.php, (c) search_price.php, and (d) product_details.php in the cosmicshop directory for CosmicShoppingCart allow remote attackers to inject arbitrary web script or HTML via multiple unspecified parameters, as demonstrated by the (1) query parameter in search.php and the (2) data parameter in search_cat.php.

• CWE-79

• http://archives.neohapsis.com/archives/fulldisclosure/2006-05/0683.html
• http://secunia.com/advisories/20272Exploit, Vendor Advisory
• http://securitytracker.com/id?1016164
• http://www.osvdb.org/26090
• http://www.osvdb.org/26091
• http://www.osvdb.org/26092
• http://www.osvdb.org/26093
• http://www.securityfocus.com/bid/18709
• http://www.vupen.com/english/advisories/2006/1984Vendor Advisory
• http://www.zone-h.org/advisories/read/id=9058Exploit, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26681
• http://archives.neohapsis.com/archives/fulldisclosure/2006-05/0683.html
• http://secunia.com/advisories/20272Exploit, Vendor Advisory
• http://securitytracker.com/id?1016164
• http://www.osvdb.org/26090
• http://www.osvdb.org/26091
• http://www.osvdb.org/26092
• http://www.osvdb.org/26093
• http://www.securityfocus.com/bid/18709
• http://www.vupen.com/english/advisories/2006/1984Vendor Advisory
• http://www.zone-h.org/advisories/read/id=9058Exploit, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26681

Published

May 30, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-2643Cross-site scripting (XSS) vulnerability in index.php in Mon…
• CVE-2006-2644AWStats 6.5, and possibly other versions, allows remote auth…
• CVE-2006-2645PHP remote file inclusion vulnerability in manager/frontinc/…
• CVE-2006-2646Buffer overflow in Alt-N MDaemon, possibly 9.0.1 and earlier…
• CVE-2006-2647Untrusted search path vulnerability in update_flash for IBM …
• CVE-2006-2648Cross-site scripting (XSS) vulnerability in perform_search.a…
• CVE-2006-2650SQL injection vulnerability in cosmicshop/search.php in Cosm…
• CVE-2006-2651Cross-site scripting (XSS) vulnerability in index.php in Vac…
• CVE-2006-2652Cross-site scripting (XSS) vulnerability in WikiNi 0.4.2 and…
• CVE-2006-2653Cross-site scripting (XSS) vulnerability in login_error.shtm…
• CVE-2006-2654Directory traversal vulnerability in smbfs smbfs on FreeBSD …
• CVE-2006-2655The build process for ypserv in FreeBSD 5.3 up to 6.1 accide…