Oscommerce vulnerabilities
96 vulnerabilities
Known vulnerabilities in Oscommerce products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 10 products.
Products
10- Oscommerce80 vulnerabilities
- Online Merchant10 vulnerabilities
- Oscommerce22 vulnerabilities
- Ce Phoenix1 vulnerabilities
- Customer Testimonials1 vulnerabilities
- Luottokunta1 vulnerabilities
- Osc2Nuke1 vulnerabilities
- Php Point Of Sale1 vulnerabilities
- Poll Booth1 vulnerabilities
- Finnish Bank Payment0 vulnerabilities
CVE-2018-25114oscommerceonline_merchant
EPSS score4.47%
A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and missing authentication in the installer workflow. By default, the /install/ directory remains accessible after installation. An unauthenticated attacker can invoke install_4.php, submit crafted POST data, and inject arbitrary PHP code into the configure.php file. When the application later includes this file, the injected payload is executed, resulting in full server-side compromise.CVE-2018-18966oscommerceonline_merchantEPSS score1.02%
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but Internet Explorer render HTML elements in a .eml file.CVE-2018-18573oscommerceoscommerceEPSS score2.61%
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated administrators can upload new '.htaccess' files (e.g., omitting .php) and subsequently achieve arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=new_product URI.CVE-2018-18572oscommerceoscommerceEPSS score2.59%
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter, script files with certain PHP-related extensions (such as .phtml and .php5) didn't execute in the application. But this filter didn't prevent the '.pht' extension. Thus, remote authenticated administrators can upload '.pht' files for arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=new_product URI.CVE-2018-18965oscommerceonline_merchantEPSS score1.02%
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but there are several alternative cases in which HTML can be executed, such as a file with no extension or an unrecognized extension (e.g., the test or test.asdf filename).CVE-2018-18964oscommerceonline_merchantEPSS score1.02%
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but there are several extensions in which contained HTML can be executed, such as the svg extension.CVE-2003-1219oscommerceoscommerceEPSS score3.32%
Cross-site scripting (XSS) vulnerability in the tep_href_link function in html_output.php for osCommerce before 2.2-MS3 allows remote attackers to inject arbitrary web script or HTML via the osCsid parameter.CVE-2015-2965oscommerceoscommerceEPSS score1.97%
Directory traversal vulnerability in osCommerce Japanese 2.2ms1j-R8 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors.CVE-2007-1477oscommercephp_point_of_saleEPSS score1.55%
Directory traversal vulnerability in index.php in PHP Point Of Sale for osCommerce 1.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cfg_language parameter. NOTE: this issue has been disputed by CVE, since the cfg_language variable is configured upon proper product installationCVE-2025-40674oscommerceoscommerceEPSS score0.49%
Reflected Cross-Site Scripting (XSS) in osCommerce v4. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the name of any parameter in /watch/en/about-us. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.CVE-2020-29070oscommerceoscommerceEPSS score1.16%
osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters.CVE-2020-27976oscommerceoscommerceEPSS score7.17%
osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option.CVE-2020-27975oscommerceoscommerceEPSS score0.61%
osCommerce Phoenix CE before 1.0.5.4 allows admin/define_language.php CSRF.CVE-2020-12058oscommercece_phoenixEPSS score0.95%
Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/order_status.php, catalog/admin/tax_rates.php, catalog/admin/languages.php, catalog/admin/countries.php, catalog/admin/tax_classes.php, catalog/admin/reviews.php, or catalog/admin/zones.php; or the zpage or spage parameter to catalog/admin/geo_zones.php.CVE-2020-23360oscommerceoscommerceEPSS score1.21%
oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/admin/administrators.php and /catalog/password_reset.phpCVE-2014-10033oscommerceonline_merchantEPSS score1.80%
SQL injection vulnerability in the update_zone function in catalog/admin/geo_zones.php in osCommerce Online Merchant 2.3.3.4 and earlier allows remote administrators to execute arbitrary SQL commands via the zID parameter in a list action.CVE-2005-2330oscommerceoscommerceEPSS score9.60%
Directory traversal vulnerability in extras/update.php in osCommerce 2.2 allows remote attackers to read arbitrary files via (1) .. sequences or (2) a full pathname in the readme_file parameter.CVE-2005-1951oscommerceoscommerceEPSS score2.34%
Multiple HTTP Response Splitting vulnerabilities in osCommerce 2.2 Milestone 2 and earlier allow remote attackers to spoof web content and poison web caches via hex-encoded CRLF ("%0d%0a") sequences in the (1) products_id or (2) pid parameter to index.php or (3) goto parameter to banner.php.CVE-2005-0458oscommerceoscommerceEPSS score1.43%
Cross-site scripting (XSS) vulnerability in contact_us.php in osCommerce 2.2-MS2 allows remote attackers to inject arbitrary web script or HTML via the enquiry parameter.CVE-2008-0719oscommercecustomer_testimonials+1EPSS score2.88%
SQL injection vulnerability in customer_testimonials.php in the Customer Testimonials 3 and 3.1 Addon for osCommerce Online Merchant 2.2 allows remote attackers to execute arbitrary SQL commands via the testimonial_id parameter.