EUVD-2008-0729

Malware in sbrugna...

PT-2025-30585 · Unknown · Oscommerce Online Merchant

Name of the Vulnerable Software and Affected Versions: osCommerce Online Merchant version 2.3.4.1 Description: A remote code execution issue exists due to insecure default configuration and missing authentication in the installer workflow. The /install/ directory remains accessible after...

CVE-2018-25114: Unrestricted Upload of File with Dangerous Type

A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and missing authentication in the installer workflow. By default, the /install/ directory remains accessible after installation. An unauthenticated attacker can...

CVE-2014-10033

SQL injection vulnerability in the updatezone function in catalog/admin/geozones.php in osCommerce Online Merchant 2.3.3.4 and earlier allows remote administrators to execute arbitrary SQL commands via the zID parameter in a list action...

CVE-2014-10033

SQL injection vulnerability in the updatezone function in catalog/admin/geozones.php in osCommerce Online Merchant 2.3.3.4 and earlier allows remote administrators to execute arbitrary SQL commands via the zID parameter in a list action...

CVE-2014-10033

The CVE-2014-10033 entry describes an SQL injection in the update_zone function of osCommerce Online Merchant 2.3.3.4 and earlier. The vulnerability exists in catalog/admin/geo_zones.php, where remote administrators can trigger arbitrary SQL execution via the zID parameter in a list action. The i...

PT-2015-3677

Name of the Vulnerable Software and Affected Versions osCommerce Online Merchant versions 2.3.3.4 and earlier Description The issue allows remote administrators to execute arbitrary SQL commands. This is achieved via the zID parameter in a list action, specifically targeting the update zone...

Oscommerce Online Merchant 2.2 - Remote File Upload

No description provided by source...

Code injection

The PayPal aka MODULEPAYMENTPAYPALSTANDARD module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

PT-2012-4418

Name of the Vulnerable Software and Affected Versions osCommerce Online Merchant versions prior to 2.3.4 PayPal aka MODULE PAYMENT PAYPAL STANDARD module version prior to 1.1 Description The issue allows remote attackers to modify the payment recipient by altering the merchant's e-mail address,...

CVE-2012-2991: Undefined Security Weakness

The PayPal aka MODULEPAYMENTPAYPALSTANDARD module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

CVE-2012-1792

Cross-site scripting XSS vulnerability in osCommerce/OM/Core/Site/Setup/Application/Install/RPC/DBCheck.php in OSCommerce Online Merchant 3.0.2, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the name parameter to oscommerce/index.php, whi...

Cross site scripting

Cross-site scripting XSS vulnerability in osCommerce/OM/Core/Site/Setup/Application/Install/RPC/DBCheck.php in OSCommerce Online Merchant 3.0.2, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the name parameter to oscommerce/index.php, whi...

CVE-2012-1792

Cross-site scripting XSS vulnerability in osCommerce/OM/Core/Site/Setup/Application/Install/RPC/DBCheck.php in OSCommerce Online Merchant 3.0.2, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the name parameter to oscommerce/index.php, whi...

PT-2012-3542

Name of the Vulnerable Software and Affected Versions OSCommerce Online Merchant version 3.0.2 Description A cross-site scripting XSS issue exists in the software during installation, allowing remote attackers to inject arbitrary web script or HTML via the name parameter to "oscommerce/index.php"...

PT-2012-4376

Name of the Vulnerable Software and Affected Versions OSCommerce Online Merchant version 3.0.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the value title parameter in the main.php file of the OSCommer...

CVE-2012-2935: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in osCommerce/OM/Core/Site/Shop/Application/Checkout/pages/main.php in OSCommerce Online Merchant 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the valuetitle parameter, a different vulnerability than CVE-2012-1059...

CVE-2012-1792: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in osCommerce/OM/Core/Site/Setup/Application/Install/RPC/DBCheck.php in OSCommerce Online Merchant 3.0.2, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the name parameter to oscommerce/index.php, whi...

CVE-2012-1059

Cross-site scripting XSS vulnerability in osCommerce/OM/Core/Site/Shop/Application/Cart/pages/main.php in OSCommerce Online Merchant 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the valuetitle parameter, as demonstrated using the "Front" field in the shirt module...

PT-2012-3048

Name of the Vulnerable Software and Affected Versions OSCommerce Online Merchant version 3.0.2 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the value title parameter. This can be demonstrated using the "Front" field in the shirt...