Login Request a demo
OM
Product
Online Merchant
by osCommerce · last CVE Jul 23, 2025
10
CVEs
0
On KEV
9.3
Max CVSS
0
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 1High 0Medium 3Low 0
Severity
All severities10Critical1High0Medium3Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Online Merchant to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2018-25114
9.3
5%
Jul 23
osCommerce 2.3.4.1 Installer Unauthenticated Configuration File Injection PHP Code Execution
Affected: 2.3.4.1
CVE-2018-18966
4.9
1%
Nov 6
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page
Affected: 2.3.4.1
CVE-2018-18965
4.9
1%
Nov 6
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page
Affected: 2.3.4.1
CVE-2018-18964
4.9
1%
Nov 6
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page
Affected: 2.3.4.1
CVE-2014-10033
–
2%
Jan 13
SQL injection vulnerability in the update_zone function in catalog/admin/geo_zones.php in osCommerce Online Merchant 2.3.3.4 and earlier allows remote administrators to execute…
Affected: through 2.3.3.4
CVE-2012-2991
–
1%
Sep 19
The PayPal (aka MODULE_PAYMENT_PAYPAL_STANDARD) module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified…
Affected: through 2.3.3; 2.3.0; 2.3.1; 2.3.2
CVE-2012-2935
–
1%
May 27
Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Shop/Application/Checkout/pages/main.php in OSCommerce Online Merchant 3.0.2 allows remote attackers to inject…
Affected: through 3.0.2; 2.2; 2.3.0; 2.3.1
CVE-2012-1792
–
1%
May 27
Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Setup/Application/Install/RPC/DBCheck.php in OSCommerce Online Merchant 3.0.2, when the software is being…
Affected: through 3.0.2; 2.2; 2.3.0; 2.3.1
CVE-2012-1059
–
3%
Feb 14
Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Shop/Application/Cart/pages/main.php in OSCommerce Online Merchant 3.0.2 allows remote attackers to inject…
Affected: 3.0.2
CVE-2012-0312
–
1%
Jan 26
Cross-site scripting (XSS) vulnerability in osCommerce 2.2MS1J before R9, and osCommerce Online Merchant before 2.3.1, allows remote attackers to inject arbitrary web script or…
Affected: through 2.3.0; 2.2
Showing 10