OS
Product
osCommerce
79
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 6Medium 42Low 0
Watch
Add osCommerce to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-18592 | 4.7 | Aug 3 | osCommerce Email Template Configuration EmailController.php EmailController sql injection Affected: 4.14.63493 |
| CVE-2015-2965 | – | Jun 28 | Directory traversal vulnerability in osCommerce Japanese 2.2ms1j-R8 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors Affected: through 2.2ms1j-r8 |
| CVE-2012-5798 | – | Nov 4 | The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the… Affected: All versions, or not specified |
| CVE-2012-5797 | – | Nov 4 | The PayPal Pro PayFlow module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509… Affected: All versions, or not specified |
| CVE-2012-5796 | – | Nov 4 | The PayPal Pro module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509… Affected: All versions, or not specified |
| CVE-2012-5795 | – | Nov 4 | The PayPal Express module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509… Affected: All versions, or not specified |
| CVE-2012-5794 | – | Nov 4 | The MoneyBookers module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509… Affected: All versions, or not specified |
| CVE-2012-5793 | – | Nov 4 | The Authorize.Net module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509… Affected: All versions, or not specified |
| CVE-2012-5792 | – | Nov 4 | The Sage Pay Direct module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509… Affected: All versions, or not specified |
| CVE-2012-0312 | – | Jan 26 | Cross-site scripting (XSS) vulnerability in osCommerce 2.2MS1J before R9, and osCommerce Online Merchant before 2.3.1, allows remote attackers to inject arbitrary web script or… Affected: 2.2ms1j-r1; 2.2ms1j-r2; 2.2ms1j-r3; 2.2ms1j-r4; 2.2ms1j-r5; 2.2ms1j-r6a; +2 more |
| CVE-2012-0311 | – | Jan 26 | Cross-site scripting (XSS) vulnerability in osCommerce 2.2MS1J before R9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: 2.2ms1j-r1; 2.2ms1j-r2; 2.2ms1j-r3; 2.2ms1j-r4; 2.2ms1j-r5; 2.2ms1j-r6a; +2 more |
| CVE-2011-4543 | – | Dec 5 | Multiple directory traversal vulnerabilities in osCommerce 3.0.2 allow remote attackers to include and execute arbitrary local files via a Affected: 3.0.2 |
| CVE-2011-3767 | – | Sep 24 | osCommerce 3.0a5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as… Affected: 3.0a5 |
| CVE-2009-0408 | – | Feb 3 | Cross-site request forgery (CSRF) vulnerability in osCommerce 2.2 RC 2a allows remote attackers to hijack the authentication of administrators Affected: 2.2 |
| CVE-2008-4170 | – | Sep 22 | create_account.php in osCommerce 2.2 RC 2a allows remote attackers to obtain sensitive information via an invalid dob parameter, which reveals the installation path in an error… Affected: 2.2 |
| CVE-2008-0719 | – | Feb 12 | SQL injection vulnerability in customer_testimonials.php in the Customer Testimonials 3 and 3.1 Addon for osCommerce Online Merchant 2.2 allows remote attackers to execute… Affected: 2.2 |
| CVE-2006-6534 | – | Dec 14 | Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 3.0a3 allow remote attackers to inject arbitrary web script or HTML via the (1) set parameter to… Affected: 3.0a3 |
| CVE-2006-6533 | – | Dec 14 | Directory traversal vulnerability in admin/templates_boxes_layout.php in osCommerce 3.0a3 allows remote attackers to include and execute arbitrary PHP files via a Affected: 3.0a3 |
| CVE-2006-5190 | – | Oct 10 | Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers to inject arbitrary web script or HTML via the (1) page… Affected: through 2.2_ms2_2006-08-17; 1.1; 1.5.1; 1.11; 1.12; 1.13; +5 more |
| CVE-2006-4298 | – | Aug 23 | Multiple directory traversal vulnerabilities in cache.php in osCommerce before 2.2 Milestone 2 060817 allow remote attackers to determine existence of arbitrary files and disclose… Affected: 2.2_ms2_2006-08-17 |
| CVE-2006-4297 | – | Aug 23 | SQL injection vulnerability in shopping_cart.php in osCommerce before 2.2 Milestone 2 060817 allows remote attackers to execute arbitrary SQL commands via id array parameters Affected: 2.2_ms2_2006-08-17 |
| CVE-2005-2330 | – | Jul 20 | Directory traversal vulnerability in extras/update.php in osCommerce 2.2 allows remote attackers to read arbitrary files via (1) Affected: 2.2_ms2 |
| CVE-2005-1951 | – | Jun 16 | Multiple HTTP Response Splitting vulnerabilities in osCommerce 2.2 Milestone 2 and earlier allow remote attackers to spoof web content and poison web caches via hex-encoded CRLF… Affected: 2.1; 2.2_cvs; 2.2_ms1; 2.2_ms2 |
| CVE-2005-0458 | – | May 2 | Cross-site scripting (XSS) vulnerability in contact_us.php in osCommerce 2.2-MS2 allows remote attackers to inject arbitrary web script or HTML via the enquiry parameter Affected: 2.2_ms2 |
| CVE-2004-2638 | – | Dec 31 | The Admin Access With Levels plugin in osCommerce 1.5.1 allows remote attackers to access files in the "admin/" directory by modifying the in_login parameter to a non-zero value Affected: 1.5.1 |
| CVE-2004-2021 | – | Dec 31 | Directory traversal vulnerability in file_manager.php in osCommerce 2.2 allows remote attackers to view arbitrary files via a Affected: 2.1; 2.2_cvs; 2.2_ms1; 2.2_ms2; 2.2_ms3 |
| CVE-2003-1219 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in the tep_href_link function in html_output.php for osCommerce before 2.2-MS3 allows remote attackers to inject arbitrary web script or… Affected: through 2.2_ms2 |
| CVE-2002-2019 | – | Dec 31 | PHP remote file inclusion vulnerability in include_once.php in osCommerce (a.k.a Affected: 2.1 |
| CVE-2002-1991 | – | Dec 31 | PHP file inclusion vulnerability in osCommerce 2.1 execute arbitrary commands via the include_file parameter to include_once.php Affected: 2.1 |