Read the docs

Os Commerce

Records97All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical7CVSS 9.0–10.0
CVSS high16CVSS 7.0–8.9

Exploited now

Os Commerce records in CISA KEV

No Os Commerce vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Oscommerce 78 records HIGH Online Merchant 9 records LOW Ce Phoenix 1 record LOW Customer Testimonials 1 record LOW Finnish Bank Payment 1 record MEDIUM Luottokunta 1 record MEDIUM Osc2nuke 1 record MEDIUM Php Point Of Sale 1 record LOW

Records

97 records

TI-2009-04916 CVE-2009-20006 · GHSA-2h4r-77vh-7qcf

osCommerce <= 2.2 Admin File Manager Arbitrary PHP Code Execution

Priority HIGH 81

osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility (admin/file_manager.php).

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.02297 Published 2025-09-16 No fix listed CWE-434
TI-2019-15550 CVE-2019-25497 · GHSA-pr7p-x9q9-qph3

osCommerce 2.3.4.1 SQL Injection via currency Parameter

Priority HIGH 77

osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the currency parameter.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00372 Published 2026-02-27 No fix listed CWE-89
TI-2019-15549 CVE-2019-25496 · GHSA-659v-qhqp-595j

osCommerce 2.3.4.1 SQL Injection via products_id Parameter

Priority HIGH 77

osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the products_id parameter.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00372 Published 2026-02-27 No fix listed CWE-89
TI-2019-15548 CVE-2019-25495 · GHSA-xxc3-jv86-6hxx

osCommerce 2.3.4.1 SQL Injection via reviews_id Parameter

Priority HIGH 77

osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the reviews_id parameter.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00372 Published 2026-02-27 No fix listed CWE-89
TI-2023-23418 CVE-2023-43713 · GHSA-xv56-c9px-vg88

Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Priority MEDIUM 58

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability, which allows attackers to inject JS via the "title" parameter, in the "/admin/admin-menu/add-submit" endpoint, which can lead to unautho…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00455 Published 2023-09-30 No fix listed CWE-79
Load more
Open these records in search →