Medium severity · published Jun 17, 2025
CVE-2025-40674
Reflected Cross-Site Scripting (XSS) in osCommerce
5.1
CVSS
0.5%
EPSS
No
On KEV
Description
Reflected Cross-Site Scripting (XSS) in osCommerce v4. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the name of any parameter in /watch/en/about-us. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
osCommerce · osCommerce
v4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-40674
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-40674
www.incibe.es
https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-oscommerce
More from osCommerce
9.8
CVE-2023-6579
osCommerce POST Parameter shopping-cart sql injection
9.8
CVE-2020-23360
oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in…
9.8
CVE-2020-27976
osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely
9.3
CVE-2009-20006
osCommerce <= 2.2 Admin File Manager Arbitrary PHP Code Execution
8.8
CVE-2020-27975
osCommerce Phoenix CE before 1.0.5.4 allows admin/define_language.php CSRF