Medium severity · published Oct 5, 2026
CVE-2026-105225
osCommerce osCommerce2 Payment payment.php include code injection
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was identified in osCommerce osCommerce2 up to 2.3.4.1. This affects the function include of the file includes/classes/payment.php of the component Payment Page. Such manipulation of the argument MODULE_PAYMENT_INSTALLED leads to code injection. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
osCommerce2 · osCommerce
2.3.4.0; 2.3.4.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-105225
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-105225
vdb-entry
https://vuldb.com/vuln/413427
signature
https://vuldb.com/vuln/413427/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-105225
third-party-advisory
https://vuldb.com/submit/971046
exploit
https://github.com/osCommerce/oscommerce2/issues/677
product
https://github.com/osCommerce/oscommerce2/
More from osCommerce2
4.7
CVE-2026-105226
osCommerce osCommerce2 Newsletter Management newsletters.php include code injection