CVE-2012-2935

Published: May 27, 2012Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Shop/Application/Checkout/pages/main.php in OSCommerce Online Merchant 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the value_title parameter, a different vulnerability than CVE-2012-1059.

Affected (5)

Products: Oscommerce: Online Merchant

Oscommerce

1 product

Online Merchant

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Oscommerce Online Merchant	All versions
Oscommerce Online Merchant	Up to 3.0.2
Oscommerce Online Merchant	Version 2.2
Oscommerce Online Merchant	Version 2.3.0
Oscommerce Online Merchant	Version 2.3.1

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://exchange.xforce.ibmcloud.com/vulnerabilities/75900

Source: cve@mitre.org

https://github.com/osCommerce/oscommerce/commit/a5aeb0448cc333cc4b801c0e01981b218fd9c7df

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/75900

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/osCommerce/oscommerce/commit/a5aeb0448cc333cc4b801c0e01981b218fd9c7df

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.