Skip to content
OpenAdvisories

Vendor

osCommerce

8 known vulnerabilities.

Products

osCommerce 5 osCommerce2 2 Online Merchant 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.7
    CVE-2026-105226

    osCommerce osCommerce2 Newsletter Management newsletters.php include code injection

    A security flaw has been discovered in osCommerce osCommerce2 up to 2.3.4.1. This vulnerability affects the function include of the file admin/newsletters.php of the component Newsletter Management. Performing a manipulation of the argument module results in …

    osCommerce osCommerce2
  • Medium 4.3
    CVE-2026-105225

    osCommerce osCommerce2 Payment payment.php include code injection

    A vulnerability was identified in osCommerce osCommerce2 up to 2.3.4.1. This affects the function include of the file includes/classes/payment.php of the component Payment Page. Such manipulation of the argument MODULE_PAYMENT_INSTALLED leads to code injectio…

    osCommerce osCommerce2
  • Medium 5.1
    CVE-2025-40674

    Reflected Cross-Site Scripting (XSS) in osCommerce

    Reflected Cross-Site Scripting (XSS) in osCommerce v4. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the name of any parameter in /watch/en/about-us. This vulnerability can…

    osCommerce osCommerce