CVE-2006-2051

NextAge Shopping Cart - Stored Cross-Site Scripting via Username and Password Parameters

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-2051. PoCs published by R@1D3N.

AI-analyzed exploit summary The provided code is a writeup describing an HTML injection vulnerability in NextAge Shopping Cart, where user-supplied input is not properly sanitized. It includes a sample form demonstrating how attacker-supplied HTML/script code could be executed in the context of the affected website.

Description

Multiple cross-site scripting (XSS) vulnerabilities in myadmin/index.php in NextAge Shopping Cart allow remote attackers to inject arbitrary web script or HTML via the (1) username and (2) password parameters.

Exploits (1)

exploitdb WRITEUP VERIFIED
by R@1D3N · textwebappsphp
https://www.exploit-db.com/exploits/27734

The provided code is a writeup describing an HTML injection vulnerability in NextAge Shopping Cart, where user-supplied input is not properly sanitized. It includes a sample form demonstrating how attacker-supplied HTML/script code could be executed in the context of the affected website.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Theoretical
Target: NextAge Shopping Cart
No auth needed
Prerequisites: Access to the vulnerable application
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/26065
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/431983/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/17685
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/791

Scores

EPSS 0.0179
EPSS Percentile 75.5%

Details

Status published
Products (1)
nextage/nextage_shopping_cart
Published Apr 26, 2006
Tracked Since Feb 18, 2026