Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2006-2165: Avactis Shopping Cart lets attackers add harmful code to web pages

CVE-2006-2165 · published 20 years ago

Summary

The Avactis Shopping Cart version 0.1.2 and earlier can let a remote user place malicious web code into pages that display product and offer information. This could cause unwanted pop‑ups, data theft, or other unwanted actions for visitors to the site. Update to a newer version of Avactis Shopping Cart or apply the vendor’s recommended patches to stop the code injection.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
pentasoft_corp.	avactis_shopping_cart	<= 0.1.2 `cpe:2.3:a:pentasoft_corp.:avactis_shopping_cart::::::::`

Original advisory text

Multiple cross-site scripting (XSS) vulnerabilities in Avactis Shopping Cart 0.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) category_id parameter in (a) store_special_offers.php and (b) store.php and (2) prod_id parameter in (c) product_info.php. NOTE: this issue might be resultant from SQL injection.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

2.6 Low

Exploitation

1% chance of attack within 30 days

Timeline

Published4 May 2006

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2006-2165 · NVD

Track software like this

Free during beta