Vulnerabilities

TI-2024-37413 CVE-2024-56526 · GHSA-qqcr-9jfc-35c4

An issue was discovered in OXID eShop before 7.

HIGH 72

An issue was discovered in OXID eShop before 7.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00372 Published 2025-05-13 Fixed in 6.14.4, 6.5.5 +1 CWE-200

TI-2023-19727 CVE-2023-38330 · GHSA-64qw-cmm8-576m

OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with…

LOW 30

OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administration area.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00421 Published 2023-08-02 No fix listed CWE-434

TI-2019-12730 CVE-2019-17062 · GHSA-8xj8-92fc-3583

An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop…

MEDIUM 40

An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop Enterprise Edition Version 5.2.x-5.3.x, OXID eShop Professional Edition Version 4.9.x-4.10.x and OXID eShop Community Edition Vers…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01168 Published 2019-11-05 No fix listed CWE-384

TI-2019-09759 CVE-2019-13026 · GHSA-4qv6-ph2q-r5mg

OXID eShop 6.0.x before 6.0.5 and 6.1.x before 6.1.4 allows SQL Injection via a crafted…

MEDIUM 45

OXID eShop 6.0.x before 6.0.5 and 6.1.x before 6.1.4 allows SQL Injection via a crafted URL, leading to full access by an attacker.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01355 Published 2019-07-30 No fix listed CWE-89

TI-2018-14698 CVE-2018-20715 · GHSA-c2g7-v2j3-67gg

The DB abstraction layer of OXID eSales 4.10.6 is vulnerable to SQL injection via the…

MEDIUM 44

The DB abstraction layer of OXID eSales 4.10.6 is vulnerable to SQL injection via the oxid or synchoxid parameter to the oxConfig::getRequestParameter() method in core/oxconfig.php.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01148 Published 2019-01-15 No fix listed CWE-89

TI-2018-09028 CVE-2018-12579 · GHSA-xpxq-36mx-cwhx

An issue was discovered in OXID eShop Enterprise Edition before 5.3.8, 6.0.x before…

LOW 38

An issue was discovered in OXID eShop Enterprise Edition before 5.3.8, 6.0.x before 6.0.3, and 6.1.x before 6.1.0; Professional Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0; and Community Edi…

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.01201 Published 2018-08-20 No fix listed CWE-640

TI-2017-11009 CVE-2017-14993 · GHSA-p38f-p5gw-455m

OXID eShop Community Edition before 6.0.0 RC3 (development), 4.10.x before 4.10.6…

LOW 35

OXID eShop Community Edition before 6.0.0 RC3 (development), 4.10.x before 4.10.6 (maintenance), and 4.9.x before 4.9.11 (legacy), Enterprise Edition before 6.0.0 RC3 (development), 5.2.x before 5.2.11 (legacy), and 5.3.…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01203 Published 2018-02-20 No fix listed CWE-425

TI-2017-09157 CVE-2017-12415 · GHSA-649v-6mm5-j8rw

OXID eShop Community Edition before 6.0.0 RC2 (development), 4.10.x before 4.10.5…

LOW 34

OXID eShop Community Edition before 6.0.0 RC2 (development), 4.10.x before 4.10.5 (maintenance), and 4.9.x before 4.9.10 (legacy), Enterprise Edition before 6.0.0 RC2 (development), 5.2.x before 5.2.10 (legacy), and 5.3.…

CVSS 3.0HIGH 7.5 Network No auth User interaction EPSS 0.0067 Published 2018-02-20 No fix listed CWE-352

TI-2018-04168 CVE-2018-5763 · GHSA-7mr9-c83q-gwfc

An issue was discovered in OXID eShop Enterprise Edition before 5.3.7 and 6.x before…

LOW 29

An issue was discovered in OXID eShop Enterprise Edition before 5.3.7 and 6.x before 6.0.1.

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.01065 Published 2018-02-19 No fix listed CWE-20

TI-2015-05777 CVE-2015-6926 · GHSA-4c39-hj99-5h2r

The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows…

LOW 35

The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows remote attackers to impersonate users via the email address in a crafted authentication token.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01069 Published 2018-01-19 Fixed in 4.5.0 CWE-287

TI-2014-04047 CVE-2014-4919 · GHSA-4cr9-w8vr-8665

OXID eShop Professional Edition before 4.7.13 and 4.8.x before 4.8.7, Enterprise Edition…

LOW 26

OXID eShop Professional Edition before 4.7.13 and 4.8.x before 4.8.7, Enterprise Edition before 5.0.13 and 5.1.x before 5.1.7, and Community Edition before 4.7.13 and 4.8.x before 4.8.7 allow remote attackers to assign u…

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00824 Published 2018-01-19 No fix listed CWE-264

TI-2014-01580 CVE-2014-2016 · GHSA-vq4f-r8pc-6pf3

Multiple cross-site scripting (XSS) vulnerabilities in OXID eShop Professional and…

LOW 23

Multiple cross-site scripting (XSS) vulnerabilities in OXID eShop Professional and Community Edition 4.6.8 and earlier, 4.7.x before 4.7.11, and 4.8.x before 4.8.4, and Enterprise Edition 4.6.8 and earlier, 5.0.x before…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01414 Published 2014-03-25 No fix listed CWE-79

TI-2013-05048 CVE-2013-5913 · GHSA-c36f-9rph-r8f8

Cross-site scripting (XSS) vulnerability in the getRecommSearch function in…

LOW 23

Cross-site scripting (XSS) vulnerability in the getRecommSearch function in recommlist.php in OXID eShop before 4.6.7, Professional and Community Edition 4.7.x before 4.7.8, and Enterprise Edition 5.x before 5.0.8 allows…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01409 Published 2013-10-15 No fix listed CWE-79

Vulnerabilities

Filters