CVE-2019-25497 | High | 8.2 | 2026-02-27 | osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th… |
CVE-2019-25496 | High | 8.2 | 2026-02-27 | osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th… |
CVE-2019-25495 | High | 8.2 | 2026-02-27 | osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th… |
CVE-2009-20006 | | | 2025-09-16 | osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility (admin/file_manager.php). The interface all… |
CVE-2018-25114 | | | 2025-07-23 | A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and missing authentication… |
CVE-2025-40674 | | | 2025-06-17 | Reflected Cross-Site Scripting (XSS) in osCommerce v4. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the… |
CVE-2024-22724 | Medium | 6.6 | 2024-03-21 | An issue was discovered in osCommerce v4, allows local attackers to bypass file upload restrictions and execute arbitrary code via administrator profile photo… |
CVE-2023-6609 | Low | 3.5 | 2023-12-08 | A vulnerability was found in osCommerce 4. It has been classified as problematic. This affects an unknown part of the file /b2b-supermarket/catalog/all-product… |
CVE-2023-6579 | High | 7.3 | 2023-12-07 | A vulnerability, which was classified as critical, has been found in osCommerce 4. Affected by this issue is some unknown functionality of the file /b2b-superm… |
CVE-2023-6296 | Medium | 4.3 | 2023-11-26 | A vulnerability was found in osCommerce 4. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /catalog/compare… |
CVE-2023-5112 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "specials_type… |
CVE-2023-5111 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "featured_type… |
CVE-2023-43735 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "formats_title… |
CVE-2023-43734 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "name" paramet… |
CVE-2023-43733 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "company_addre… |
CVE-2023-43732 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "tax_class_tit… |
CVE-2023-43731 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "zone_name" pa… |
CVE-2023-43730 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "countries_nam… |
CVE-2023-43729 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "xsell_type_na… |
CVE-2023-43728 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "stock_deliver… |
CVE-2023-43727 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "stock_indicat… |
CVE-2023-43726 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "orders_produc… |
CVE-2023-43725 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "orders_produc… |
CVE-2023-43724 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "derb6zmklgtju… |
CVE-2023-43723 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "orders_status… |
CVE-2023-43722 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "orders_status… |
CVE-2023-43721 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "PACKING_SLIPS… |
CVE-2023-43720 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "BILLING_GENDE… |
CVE-2023-43719 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "SHIPPING_GEND… |
CVE-2023-43718 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "MSEARCH_ENABL… |
CVE-2023-43717 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "MSEARCH_HIGHL… |
CVE-2023-43716 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "MAX_DISPLAY_N… |
CVE-2023-43715 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "ENTRY_FIRST_N… |
CVE-2023-43714 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "SKIP_CART_PAG… |
CVE-2023-43713 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability,
which allows attackers to inject JS via the "title" parameter, in the "/adm… |
CVE-2023-43712 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "access_levels… |
CVE-2023-43711 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "admin_firstna… |
CVE-2023-43710 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "configuration… |
CVE-2023-43709 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "configuration… |
CVE-2023-43708 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "configuration… |
CVE-2023-43707 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "CatalogsPageD… |
CVE-2023-43706 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "email_templat… |
CVE-2023-43705 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "translation_v… |
CVE-2023-43704 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "title" parame… |
CVE-2023-43703 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "product_info[… |
CVE-2023-43702 | Medium | 5.4 | 2023-09-30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "tracking_numb… |
CVE-2022-35212 | Medium | 6.1 | 2022-08-18 | osCommerce2 before v2.3.4.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the function tep_db_error(). |
CVE-2020-23360 | Critical | 9.8 | 2021-01-27 | oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/adm… |
CVE-2020-29070 | Medium | 4.8 | 2020-11-25 | osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters. |
CVE-2020-27976 | Critical | 9.8 | 2020-10-28 | osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This… |
CVE-2020-27975 | High | 8.8 | 2020-10-28 | osCommerce Phoenix CE before 1.0.5.4 allows admin/define_language.php CSRF. |
CVE-2020-12058 | Medium | 6.1 | 2020-09-03 | Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can b… |
CVE-2018-18573 | High | 7.2 | 2019-08-22 | osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated administrators can upload new '.htaccess'… |
CVE-2018-18572 | High | 7.2 | 2019-08-22 | osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter, script files with certain PHP-related e… |
CVE-2018-18966 | Medium | 4.9 | 2018-11-06 | osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension… |
CVE-2018-18965 | Medium | 4.9 | 2018-11-06 | osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension… |
CVE-2018-18964 | Medium | 4.9 | 2018-11-06 | osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension… |
CVE-2015-2965 | | | 2015-06-28 | Directory traversal vulnerability in osCommerce Japanese 2.2ms1j-R8 and earlier allows remote authenticated administrators to read arbitrary files via unspecif… |
CVE-2014-10033 | | | 2015-01-13 | SQL injection vulnerability in the update_zone function in catalog/admin/geo_zones.php in osCommerce Online Merchant 2.3.3.4 and earlier allows remote administ… |
CVE-2012-5798 | | | 2012-11-04 | The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltNa… |
CVE-2012-5797 | | | 2012-11-04 | The PayPal Pro PayFlow module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName… |
CVE-2012-5796 | | | 2012-11-04 | The PayPal Pro module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of… |
CVE-2012-5795 | | | 2012-11-04 | The PayPal Express module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName fiel… |
CVE-2012-5794 | | | 2012-11-04 | The MoneyBookers module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field… |
CVE-2012-5793 | | | 2012-11-04 | The Authorize.Net module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field… |
CVE-2012-5792 | | | 2012-11-04 | The Sage Pay Direct module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName fie… |
CVE-2012-2991 | | | 2012-09-19 | The PayPal (aka MODULE_PAYMENT_PAYPAL_STANDARD) module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipie… |
CVE-2012-2935 | | | 2012-05-27 | Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Shop/Application/Checkout/pages/main.php in OSCommerce Online Merchant 3.0.2 allows remote… |
CVE-2012-1792 | | | 2012-05-27 | Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Setup/Application/Install/RPC/DBCheck.php in OSCommerce Online Merchant 3.0.2, when the sof… |
CVE-2012-1059 | | | 2012-02-14 | Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Shop/Application/Cart/pages/main.php in OSCommerce Online Merchant 3.0.2 allows remote atta… |
CVE-2012-0312 | | | 2012-01-26 | Cross-site scripting (XSS) vulnerability in osCommerce 2.2MS1J before R9, and osCommerce Online Merchant before 2.3.1, allows remote attackers to inject arbitr… |
CVE-2012-0311 | | | 2012-01-26 | Cross-site scripting (XSS) vulnerability in osCommerce 2.2MS1J before R9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2011-4543 | | | 2011-12-05 | Multiple directory traversal vulnerabilities in osCommerce 3.0.2 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the… |
CVE-2011-3767 | | | 2011-09-24 | osCommerce 3.0a5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error m… |
CVE-2009-2039 | | | 2009-06-12 | Unspecified vulnerability in the Luottokunta module before 1.3 for osCommerce has unknown impact and attack vectors related to orders. |
CVE-2009-2038 | | | 2009-06-12 | Unspecified vulnerability in the Finnish Bank Payment module 2.2 for osCommerce has unknown impact and attack vectors related to bank charges. |
CVE-2009-0408 | | | 2009-02-03 | Cross-site request forgery (CSRF) vulnerability in osCommerce 2.2 RC 2a allows remote attackers to hijack the authentication of administrators. |
CVE-2008-4765 | | | 2008-10-28 | SQL injection vulnerability in pollBooth.php in osCommerce Poll Booth Add-On 2.0 allows remote attackers to execute arbitrary SQL commands via the pollID param… |
CVE-2008-4170 | | | 2008-09-22 | create_account.php in osCommerce 2.2 RC 2a allows remote attackers to obtain sensitive information via an invalid dob parameter, which reveals the installation… |
CVE-2008-0719 | | | 2008-02-12 | SQL injection vulnerability in customer_testimonials.php in the Customer Testimonials 3 and 3.1 Addon for osCommerce Online Merchant 2.2 allows remote attacker… |
CVE-2007-1477 | | | 2007-03-16 | Directory traversal vulnerability in index.php in PHP Point Of Sale for osCommerce 1.1 allows remote attackers to include and execute arbitrary local files via… |
CVE-2006-6534 | | | 2006-12-14 | Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 3.0a3 allow remote attackers to inject arbitrary web script or HTML via the (1) set parameter… |
CVE-2006-6533 | | | 2006-12-14 | Directory traversal vulnerability in admin/templates_boxes_layout.php in osCommerce 3.0a3 allows remote attackers to include and execute arbitrary PHP files vi… |
CVE-2006-5190 | | | 2006-10-10 | Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers to inject arbitrary web script or HTML v… |
CVE-2006-4298 | | | 2006-08-23 | Multiple directory traversal vulnerabilities in cache.php in osCommerce before 2.2 Milestone 2 060817 allow remote attackers to determine existence of arbitrar… |
CVE-2006-4297 | | | 2006-08-23 | SQL injection vulnerability in shopping_cart.php in osCommerce before 2.2 Milestone 2 060817 allows remote attackers to execute arbitrary SQL commands via id a… |
CVE-2005-4677 | | | 2005-12-31 | SQL injection vulnerability in additional_images.php (aka the Additional Images module) before 1.14 in osCommerce allows remote attackers to execute arbitrary… |
CVE-2005-2330 | | | 2005-07-20 | Directory traversal vulnerability in extras/update.php in osCommerce 2.2 allows remote attackers to read arbitrary files via (1) .. sequences or (2) a full pat… |
CVE-2005-1951 | | | 2005-06-16 | Multiple HTTP Response Splitting vulnerabilities in osCommerce 2.2 Milestone 2 and earlier allow remote attackers to spoof web content and poison web caches vi… |
CVE-2005-0458 | | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in contact_us.php in osCommerce 2.2-MS2 allows remote attackers to inject arbitrary web script or HTML via the enquiry… |
CVE-2004-2638 | | | 2004-12-31 | The Admin Access With Levels plugin in osCommerce 1.5.1 allows remote attackers to access files in the "admin/" directory by modifying the in_login parameter t… |
CVE-2004-2021 | | | 2004-12-31 | Directory traversal vulnerability in file_manager.php in osCommerce 2.2 allows remote attackers to view arbitrary files via a .. (dot dot) in the filename argu… |
CVE-2004-2044 | | | 2004-06-01 | PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not properly… |
CVE-2003-1219 | | | 2003-12-31 | Cross-site scripting (XSS) vulnerability in the tep_href_link function in html_output.php for osCommerce before 2.2-MS3 allows remote attackers to inject arbit… |
CVE-2002-2019 | | | 2002-12-31 | PHP remote file inclusion vulnerability in include_once.php in osCommerce (a.k.a. Exchange Project) 2.1 allows remote attackers to execute arbitrary PHP code v… |
CVE-2002-1991 | | | 2002-12-31 | PHP file inclusion vulnerability in osCommerce 2.1 execute arbitrary commands via the include_file parameter to include_once.php. |