Os Commerce

Records97All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical7CVSS 9.0–10.0

CVSS high16CVSS 7.0–8.9

Exploited now

Os Commerce records in CISA KEV

No Os Commerce vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Oscommerce 78 records HIGH Online Merchant 9 records LOW Ce Phoenix 1 record LOW Customer Testimonials 1 record LOW Finnish Bank Payment 1 record MEDIUM Luottokunta 1 record MEDIUM Osc2nuke 1 record MEDIUM Php Point Of Sale 1 record LOW

Records

9 records in Online Merchant · all components

TI-2014-08195 CVE-2014-10033 · GHSA-5hjq-79rv-cvf4

SQL injection vulnerability in the update_zone function in catalog/admin/geo_zones.php in…

LOW 32

SQL injection vulnerability in the update_zone function in catalog/admin/geo_zones.php in osCommerce Online Merchant 2.3.3.4 and earlier allows remote administrators to execute arbitrary SQL commands via the zID paramete…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01798 Published 2015-01-13 No fix listed CWE-89

TI-2012-00967 CVE-2012-1059 · GHSA-r4v4-hvh4-c2h8

Cross-site scripting (XSS) vulnerability in…

LOW 26

Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Shop/Application/Cart/pages/main.php in OSCommerce Online Merchant 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the value_ti…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03406 Published 2012-02-14 No fix listed CWE-79

TI-2012-02595 CVE-2012-2991 · GHSA-2g72-w35q-vw79

The PayPal (aka MODULE_PAYMENT_PAYPAL_STANDARD) module before 1.1 in osCommerce Online…

LOW 25

The PayPal (aka MODULE_PAYMENT_PAYPAL_STANDARD) module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0114 Published 2012-09-19 No fix listed

TI-2018-13438 CVE-2018-18966 · GHSA-63rf-qrfc-rr7q

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product"…

LOW 24

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page.

CVSS 3.0MEDIUM 4.9 Network High privileges No interaction EPSS 0.01017 Published 2018-11-06 No fix listed

TI-2018-13437 CVE-2018-18965 · GHSA-q34m-cx6f-fm77

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product"…

LOW 24

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page.

CVSS 3.0MEDIUM 4.9 Network High privileges No interaction EPSS 0.01017 Published 2018-11-06 No fix listed

TI-2018-13436 CVE-2018-18964 · GHSA-3fqj-hqqx-wwf2

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product"…

LOW 24

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page.

CVSS 3.0MEDIUM 4.9 Network High privileges No interaction EPSS 0.01017 Published 2018-11-06 No fix listed

TI-2012-02547 CVE-2012-2935 · GHSA-rx6w-7424-25q4

Cross-site scripting (XSS) vulnerability in…

LOW 22

Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Shop/Application/Checkout/pages/main.php in OSCommerce Online Merchant 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the valu…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.00921 Published 2012-05-27 No fix listed CWE-79

TI-2012-00299 CVE-2012-0312 · GHSA-j43q-5fhx-qhvg

Cross-site scripting (XSS) vulnerability in osCommerce 2.2MS1J before R9, and osCommerce…

LOW 22

Cross-site scripting (XSS) vulnerability in osCommerce 2.2MS1J before R9, and osCommerce Online Merchant before 2.3.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01042 Published 2012-01-26 No fix listed CWE-79

TI-2012-01579 CVE-2012-1792 · GHSA-8w73-522j-5x38

Cross-site scripting (XSS) vulnerability in…

LOW 15

Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Setup/Application/Install/RPC/DBCheck.php in OSCommerce Online Merchant 3.0.2, when the software is being installed, allows remote attackers to inject a…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.00865 Published 2012-05-27 No fix listed CWE-79

Open these records in search →