$ cve CVE-2005-1486 JSON

CVE-2005-1486 EXPLOIT

5.0

MEDIUM · CVSS 2.0 · EPSS 4% (pctl 90)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting vulnerabilities in FishCart 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) trackingnum, (2) reqagree, or (3) m parameter to upstracking.php or (4) nlst parameter to display.php. NOTE: the vendor was not able to reproduce some of the reported vectors but believes that they have been addressed. The original researcher is known to be unreliable.

Scoring

CVSS	5.0 (MEDIUM, v2.0)
Vector	AV:N/AC:L/Au:N/C:N/I:P/A:N
EPSS	3.99% — more likely to be exploited than 90% of all CVEs
Weakness	CWE-79
On CISA KEV	no
Public exploit	yes
Published	2005-05-11
Last modified	2026-06-16

Affected (1)

Vendor	Product
fishnet	fishcart

Public exploits

Source	Title	Date
exploit-db	FishCart 3.1 - 'display.php?nlst' Cross-Site Scripting	2005-05-04
exploit-db	FishCart 3.1 - 'upstracking.php' Multiple Cross-Site Scripting Vulnerabilities	2005-05-04

References

→ the Explorer · watch your stack · NVD