OS
Vendor
Oscommerce
97
CVEs
0
On KEV
2
New 30D
Products
OS4.7
osCommerce2
osCommerce
2 CVEs0 on KEV2 new
OS9.8
osCommerce
Oscommerce
79 CVEs0 on KEV0 new
OM4.9
Online Merchant
Oscommerce
9 CVEs0 on KEV0 new
CP6.1
CE Phoenix
Oscommerce
1 CVEs0 on KEV0 new
CT–
Customer Testimonials
Oscommerce
1 CVEs0 on KEV0 new
FB–
Finnish Bank Payment
Oscommerce
1 CVEs0 on KEV0 new
LU–
Luottokunta
Oscommerce
1 CVEs0 on KEV0 new
OS–
Osc2nuke
Oscommerce
1 CVEs0 on KEV0 new
PP–
Php Point OF Sale
Oscommerce
1 CVEs0 on KEV0 new
PB–
Poll Booth
Oscommerce
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-105226 | OS osCommerce2 osCommerce | 4.7 | Oct 5 | osCommerce osCommerce2 Newsletter Management newsletters.php include code injection |
| CVE-2026-105225 | OS osCommerce2 osCommerce | 4.3 | Oct 5 | osCommerce osCommerce2 Payment payment.php include code injection |
| CVE-2026-18592 | OS osCommerce Oscommerce | 4.7 | Aug 3 | osCommerce Email Template Configuration EmailController.php EmailController sql injection |
| CVE-2019-25497 | OS osCommerce Oscommerce | 7.5 | Feb 27 | osCommerce 2.3.4.1 SQL Injection via currency Parameter |
| CVE-2019-25496 | OS osCommerce Oscommerce | 7.5 | Feb 27 | osCommerce 2.3.4.1 SQL Injection via products_id Parameter |
| CVE-2019-25495 | OS osCommerce Oscommerce | 7.5 | Feb 27 | osCommerce 2.3.4.1 SQL Injection via reviews_id Parameter |
| CVE-2024-22724 | OS Oscommerce Oscommerce | 6.6 | Mar 21 | An issue was discovered in osCommerce v4, allows local attackers to bypass file upload restrictions and execute arbitrary code via administrator profile photo upload feature |
| CVE-2023-6609 | OS Oscommerce Oscommerce | 6.1 | Dec 8 | A vulnerability was found in osCommerce 4 |
| CVE-2023-6579 | OS Oscommerce Oscommerce | 9.8 | Dec 7 | A vulnerability, which was classified as critical, has been found in osCommerce 4 |
| CVE-2023-6296 | OS Oscommerce Oscommerce | 6.1 | Nov 26 | A vulnerability was found in osCommerce 4 |
| CVE-2023-5112 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-5111 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43735 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43734 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43733 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43732 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43731 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43730 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43729 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43728 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43727 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43726 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43725 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43724 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43723 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43722 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43721 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43720 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43719 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43718 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43717 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43716 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43715 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43714 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43713 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability, which allows attackers to inject JS via the "title" parameter, in the… |
| CVE-2023-43712 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43711 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43710 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43709 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43708 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43707 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43706 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43705 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43704 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43703 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2023-43702 | OS Oscommerce Oscommerce | 5.4 | Sep 30 | Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability |
| CVE-2022-35212 | OS Oscommerce Oscommerce | 6.1 | Aug 18 | osCommerce2 before v2.3.4.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the function tep_db_error() |
| CVE-2020-23360 | OS Oscommerce Oscommerce | 9.8 | Jan 27 | oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in… |
| CVE-2020-29070 | OS Oscommerce Oscommerce | 4.8 | Nov 25 | osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters |
| CVE-2020-27976 | OS Oscommerce Oscommerce | 9.8 | Oct 28 | osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely |
| CVE-2020-27975 | OS Oscommerce Oscommerce | 8.8 | Oct 28 | osCommerce Phoenix CE before 1.0.5.4 allows admin/define_language.php CSRF |
| CVE-2020-12058 | CP CE Phoenix Oscommerce | 6.1 | Sep 3 | Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code |
| CVE-2018-18573 | OS Oscommerce Oscommerce | 7.2 | Aug 22 | osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page |
| CVE-2018-18572 | OS Oscommerce Oscommerce | 7.2 | Aug 22 | osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page |
| CVE-2018-18966 | OM Online Merchant Oscommerce | 4.9 | Nov 6 | osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page |
| CVE-2018-18965 | OM Online Merchant Oscommerce | 4.9 | Nov 6 | osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page |
| CVE-2018-18964 | OM Online Merchant Oscommerce | 4.9 | Nov 6 | osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page |
| CVE-2015-2965 | OS Oscommerce Oscommerce | – | Jun 28 | Directory traversal vulnerability in osCommerce Japanese 2.2ms1j-R8 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors |
| CVE-2014-10033 | OM Online Merchant Oscommerce | – | Jan 13 | SQL injection vulnerability in the update_zone function in catalog/admin/geo_zones.php in osCommerce Online Merchant 2.3.3.4 and earlier allows remote administrators to execute… |
| CVE-2012-5798 | OS Oscommerce Oscommerce | – | Nov 4 | The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the… |