Vulnerabilities

TI-2026-67700 CVE-2026-105226 · GHSA-pwh4-88m7-gc6w

osCommerce2 Newsletter Management newsletters.php include code injection

MEDIUM 56

A security flaw has been discovered in osCommerce osCommerce2 up to 2.3.4.1.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00248 Published 2026-10-05 No fix listed CWE-74

TI-2026-67699 CVE-2026-105225 · GHSA-6pgm-x34p-7c8h

Code injection in osCommerce2 payment page through payment.php

MEDIUM 55

A vulnerability was identified in osCommerce osCommerce2 up to 2.3.4.1.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00186 Published 2026-10-05 No fix listed CWE-74

TI-2019-15550 CVE-2019-25497 · GHSA-pr7p-x9q9-qph3

osCommerce 2.3.4.1 SQL Injection via currency Parameter

HIGH 77

osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the currency parameter.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00372 Published 2026-02-27 No fix listed CWE-89

TI-2019-15549 CVE-2019-25496 · GHSA-659v-qhqp-595j

osCommerce 2.3.4.1 SQL Injection via products_id Parameter

HIGH 77

osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the products_id parameter.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00372 Published 2026-02-27 No fix listed CWE-89

TI-2019-15548 CVE-2019-25495 · GHSA-xxc3-jv86-6hxx

osCommerce 2.3.4.1 SQL Injection via reviews_id Parameter

HIGH 77

osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the reviews_id parameter.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00372 Published 2026-02-27 No fix listed CWE-89

TI-2009-04916 CVE-2009-20006 · GHSA-2h4r-77vh-7qcf

osCommerce <= 2.2 Admin File Manager Arbitrary PHP Code Execution

HIGH 81

osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility (admin/file_manager.php).

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.02297 Published 2025-09-16 No fix listed CWE-434

TI-2018-15340 CVE-2018-25114 · GHSA-7hjh-7hp4-wr4c

osCommerce 2.3.4.1 Installer Unauthenticated Configuration File Injection PHP Code Execution

HIGH 81

A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and missing authentication in the installer workflow.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.04564 Published 2025-07-23 No fix listed CWE-434

TI-2025-27144 CVE-2025-40674 · GHSA-5fqq-j3v5-v823

Cross-site scripting in osCommerce

LOW 30

Reflected Cross-Site Scripting (XSS) in osCommerce v4.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00494 Published 2025-06-17 No fix listed CWE-79

TI-2024-15115 CVE-2024-22724 · GHSA-h2ph-x33p-jmpm

An issue was discovered in osCommerce v4, allows local attackers to bypass file upload…

LOW 31

An issue was discovered in osCommerce v4, allows local attackers to bypass file upload restrictions and execute arbitrary code via administrator profile photo upload feature.

CVSS 3.1MEDIUM 6.6 Local Low privileges No interaction EPSS 0.00306 Published 2024-03-21 No fix listed CWE-94

TI-2023-06056 CVE-2023-6609 · GHSA-c5f3-pmwj-p3j9

osCommerce all-products cross site scripting

LOW 27

A vulnerability was found in osCommerce 4.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00411 Published 2023-12-08 No fix listed CWE-79

TI-2023-06030 CVE-2023-6579 · GHSA-qwxv-28w8-65wx

osCommerce POST Parameter shopping-cart sql injection

MEDIUM 63

A vulnerability, which was classified as critical, has been found in osCommerce 4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.24027 Published 2023-12-07 No fix listed CWE-89

TI-2023-05779 CVE-2023-6296 · GHSA-63fm-6c9f-hvf6

osCommerce Instant Message compare cross site scripting

LOW 29

A vulnerability was found in osCommerce 4.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00805 Published 2023-11-26 No fix listed CWE-79

TI-2023-04701 CVE-2023-5112 · GHSA-vch9-j5hj-9hcp