CVE-2020-12058

Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code

published September 3, 2020

CVSS
—
EPSS
1%
Percentile
60.9
In the wild
Unconfirmed
What it is

Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/order_status.php, catalog/admin/tax_rates.php, catalog/admin/languages.php, catalog/admin/countries.php, catalog/admin/tax_classes.php, catalog/admin/reviews.php, or catalog/admin/zones.php; or the zpage or spage parameter to catalog/admin/geo_zones.php.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00952 · 60.9th percentile
Published
2020-09-03T13:09Z
EPSS history
Timeline
  • 03 SEP 13:09Z
    Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code
    cvelistv5