Vulnerabilities

TI-2023-11422 CVE-2023-26260 · GHSA-65vp-436r-q4g3

OXID eShop 6.2.x before 6.4.4 and 6.5.x before 6.5.2 allows session hijacking, leading to…

LOW 24

OXID eShop 6.2.x before 6.4.4 and 6.5.x before 6.5.2 allows session hijacking, leading to partial access of a customer's account by an attacker, due to an improper check of the user agent.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.0036 Published 2023-04-11 No fix listed CWE-384

TI-2016-04389 CVE-2016-5072 · GHSA-6r7w-whmg-2357

Code injection in OXID eShop before 2016-06-13

MEDIUM 42

OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01916 Published 2017-04-10 No fix listed CWE-94

TI-2009-02967 CVE-2009-3112 · GHSA-3pw2-f952-6q7c

Unspecified vulnerability in OXID eShop Professional, Enterprise, and Community Edition…

MEDIUM 47

Unspecified vulnerability in OXID eShop Professional, Enterprise, and Community Edition before 4.1.0 allows remote attackers to gain administrator privileges and access the shop backend via a crafted parameter.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.01988 Published 2009-09-09 No fix listed

Vulnerabilities

Filters

OXID eShop 6.2.x before 6.4.4 and 6.5.x before 6.5.2 allows session hijacking, leading to…

Code injection in OXID eShop before 2016-06-13

Unspecified vulnerability in OXID eShop Professional, Enterprise, and Community Edition…