CVE-2020-12058

Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/order_status.php, catalog/admin/tax_rates.php, catalog/admin/languages.php, catalog/admin/countries.php, catalog/admin/tax_classes.php, catalog/admin/reviews.php, or catalog/admin/zones.php; or the zpage or spage parameter to catalog/admin/geo_zones.php.

• CWE-79

• https://github.com/gburton/CE-Phoenix/commit/8d0fb97810bc28880415a3a31607f473bfc5fec8Patch, Third Party Advisory
• https://sisl.lab.uic.edu/projects/chess/cross-site-scripting-in-cephoenix/Third Party Advisory
• https://www.oscommerce.com/Us&News=155Vendor Advisory
• https://github.com/gburton/CE-Phoenix/commit/8d0fb97810bc28880415a3a31607f473bfc5fec8Patch, Third Party Advisory
• https://sisl.lab.uic.edu/projects/chess/cross-site-scripting-in-cephoenix/Third Party Advisory
• https://www.oscommerce.com/Us&News=155Vendor Advisory

Published

Sep 3, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1205<p>A spoofing vulnerability exists when Microsoft SharePoint…4.6
• CVE-2020-12050SQLiteODBC 0.9996, as packaged for certain Linux distributio…7
• CVE-2020-12051The CentralAuth extension through REL1_34 for MediaWiki allo…7.5
• CVE-2020-12052Grafana version < 6.7.3 is vulnerable for annotation popup X…6.1
• CVE-2020-12053In Unisys Stealth 3.4.x, 4.x and 5.x before 5.0.026, if cert…9.8
• CVE-2020-12054The Catch Breadcrumb plugin before 1.5.4 for WordPress allow…6.1
• CVE-2020-12059An issue was discovered in Ceph through 13.2.9. A POST reque…7.5
• CVE-2020-1206An information disclosure vulnerability exists in the way th…7.5
• CVE-2020-12061An issue was discovered in Nitrokey FIDO U2F firmware throug…9.8
• CVE-2020-12062The scp client in OpenSSH 8.2 incorrectly sends duplicate re…7.5
• CVE-2020-12063A certain Postfix 2.10.1-7 package could allow an attacker t…5.3
• CVE-2020-12066CServer::SendMsg in engine/server/server.cpp in Teeworlds 0.…7.5