Unscored severity · published Jan 26, 2012
CVE-2012-0312
Cross-site scripting (XSS) vulnerability in osCommerce 2.2MS1J before R9, and osCommerce Online Merchant before 2.3.1, allows remote attackers to inject arbitrary web script or…
–
CVSS
1%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in osCommerce 2.2MS1J before R9, and osCommerce Online Merchant before 2.3.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OM
Online Merchant · Oscommerce
through 2.3.0; 2.2 · source: NVD
OS
Oscommerce · Oscommerce
2.2ms1j-r1; 2.2ms1j-r2; 2.2ms1j-r3; 2.2ms1j-r4; 2.2ms1j-r5; 2.2ms1j-r6a; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-0312
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-0312
jvn.jp
http://jvn.jp/en/jp/JVN64386898/index.html
jvndb.jvn.jp
http://jvndb.jvn.jp/jvndb/JVNDB-2012-000005
sourceforge.jp
http://sourceforge.jp/forum/forum.php?forum_id=28119
More from Online Merchant
4.9
CVE-2018-18966
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page
4.9
CVE-2018-18965
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page
4.9
CVE-2018-18964
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page
–
CVE-2014-10033
SQL injection vulnerability in the update_zone function in catalog/admin/geo_zones.php in osCommerce Online Merchant 2.3.3.4 and earlier allows remote administrators to execute…
–
CVE-2012-2991
The PayPal (aka MODULE_PAYMENT_PAYPAL_STANDARD) module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified…