Oscommerce

oscommerce

Vendor: Oscommerce • 78 CVEs

CVEs (78)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-43704 1Oscommerce 1Oscommerce Nov 21, 2024 Sep 30, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "title" parameter, potentially leading to unauthorized execution of scripts...Show more Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "title" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.Show less
CVE-2023-43703 1Oscommerce 1Oscommerce Nov 21, 2024 Sep 30, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "product_info[][name]" parameter, potentially leading to unauthorized execu...Show more Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "product_info[][name]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.Show less
CVE-2023-43702 1Oscommerce 1Oscommerce Nov 21, 2024 Sep 30, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "tracking_number" parameter, potentially leading to unauthorized execution...Show more Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "tracking_number" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.Show less
CVE-2022-35212 1Oscommerce 1Oscommerce Nov 21, 2024 Aug 18, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 osCommerce2 before v2.3.4.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the function tep_db_error().
CVE-2020-23360 1Oscommerce 1Oscommerce Nov 21, 2024 Jan 27, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/admin/administrators.php and /catalog/password_reset.php
CVE-2020-29070 1Oscommerce 1Oscommerce Nov 21, 2024 Nov 25, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters.
CVE-2020-27976 1Oscommerce 1Oscommerce Nov 21, 2024 Oct 28, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option.
CVE-2020-27975 1Oscommerce 1Oscommerce Nov 21, 2024 Oct 28, 2020 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 osCommerce Phoenix CE before 1.0.5.4 allows admin/define_language.php CSRF.
CVE-2018-18573 1Oscommerce 1Oscommerce Nov 21, 2024 Aug 22, 2019 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated administrators can upload new '.htaccess' files (e.g., omitting .php) and subsequently achieve arbitrar...Show more osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated administrators can upload new '.htaccess' files (e.g., omitting .php) and subsequently achieve arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=new_product URI.Show less
CVE-2018-18572 1Oscommerce 1Oscommerce Nov 21, 2024 Aug 22, 2019 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter, script files with certain PHP-related extensions (such as .phtml and .php5) didn't execute in the ap...Show more osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter, script files with certain PHP-related extensions (such as .phtml and .php5) didn't execute in the application. But this filter didn't prevent the '.pht' extension. Thus, remote authenticated administrators can upload '.pht' files for arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=new_product URI.Show less
CVE-2015-2965 1Oscommerce 1Oscommerce May 6, 2026 Jun 28, 2015 N/A· v4 N/A· v3 4.0 MEDIUM· v2 Directory traversal vulnerability in osCommerce Japanese 2.2ms1j-R8 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors.
CVE-2012-5798 2Oscommerce Paypal 2Oscommerce Payflow Pro Express Checkout Apr 29, 2026 Nov 4, 2012 N/A· v4 N/A· v3 5.8 MEDIUM· v2 The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-mi...Show more The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.Show less
CVE-2012-5797 2Brian Burton Oscommerce 2Oscommerce Paypal Pro Payflow Module Apr 29, 2026 Nov 4, 2012 N/A· v4 N/A· v3 5.8 MEDIUM· v2 The PayPal Pro PayFlow module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middl...Show more The PayPal Pro PayFlow module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.Show less
CVE-2012-5796 2Oscommerce Paypal 2Oscommerce Paypal Pro Apr 29, 2026 Nov 4, 2012 N/A· v4 N/A· v3 5.8 MEDIUM· v2 The PayPal Pro module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attack...Show more The PayPal Pro module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.Show less
CVE-2012-5795 2Akunamachata Oscommerce 2Oscommerce Paypal Express Module Apr 29, 2026 Nov 4, 2012 N/A· v4 N/A· v3 5.8 MEDIUM· v2 The PayPal Express module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle at...Show more The PayPal Express module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.Show less
CVE-2012-5794 2Moneybookers Oscommerce 2Moneybookers Oscommerce Apr 29, 2026 Nov 4, 2012 N/A· v4 N/A· v3 5.8 MEDIUM· v2 The MoneyBookers module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle atta...Show more The MoneyBookers module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.Show less
CVE-2012-5793 2Harald Ponce De Leon Oscommerce 2Authorize.net Oscommerce Apr 29, 2026 Nov 4, 2012 N/A· v4 N/A· v3 5.8 MEDIUM· v2 The Authorize.Net module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle att...Show more The Authorize.Net module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.Show less
CVE-2012-5792 2Oscommerce Sagepay 2Oscommerce Sage Pay Direct Module Apr 29, 2026 Nov 4, 2012 N/A· v4 N/A· v3 5.8 MEDIUM· v2 The Sage Pay Direct module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle a...Show more The Sage Pay Direct module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.Show less
CVE-2012-0312 1Oscommerce 2Online Merchant Oscommerce Apr 29, 2026 Jan 26, 2012 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in osCommerce 2.2MS1J before R9, and osCommerce Online Merchant before 2.3.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-0311 1Oscommerce 1Oscommerce Apr 29, 2026 Jan 26, 2012 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in osCommerce 2.2MS1J before R9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Previous 1 234 Next