CVE-2006-1096
** DISPUTED ** Cross-site scripting (XSS) vulnerability in index.php in NZ Ecommerce allows...
CVE-2006-1096 is a medium vulnerability (CVSS 4.3) in Digital Builder Nz Ecommerce, published March 9, 2006. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 1.25%, the 69th percentile.
Cross-site scripting (XSS) vulnerability in index.php in NZ Ecommerce allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a legitimate problem
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in index.php in NZ Ecommerce allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a legitimate problem
- Record
CVE-2006-1096- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in index.php in NZ Ecommerce allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a legitimate problem
- Record
CVE-2006-1096- Updated
- 2026-11-02
EUVDEUVD-2006-1100 No score
Cross-site scripting (XSS) vulnerability in index.php in NZ Ecommerce allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a legitimate problem
- Record
EUVD-2006-1100- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3xxg-cfxh-f9rh No score
** DISPUTED ** Cross-site scripting (XSS) vulnerability in index.php in NZ Ecommerce allows...
** DISPUTED ** Cross-site scripting (XSS) vulnerability in index.php in NZ Ecommerce allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a legitimate problem.
- Record
GHSA-3xxg-cfxh-f9rh- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |
