826 matches found
CVE-2019-25496 osCommerce 2.3.4.1 SQL Injection via products_id Parameter
osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the productsid parameter. Attackers can modify the productsid value in productinfo.php requests and append boolean-based SQL injection...
CVE-2019-25496
osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the productsid parameter. Attackers can modify the productsid value in productinfo.php requests and append boolean-based SQL injection...
CVE-2019-25496
CVE-2019-25496 affects osCommerce 2.3.4.1. The vulnerability is a SQL injection in the products_id parameter used by product_info.php, allowing unauthenticated attackers to manipulate database queries and extract sensitive information by appending boolean-based payloads. The described exploit pat...
CVE-2019-25495 osCommerce 2.3.4.1 SQL Injection via reviews_id Parameter
osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the reviewsid parameter. Attackers can send GET requests to productreviewswrite.php with malicious reviewsid values using boolean-based SQL...
CVE-2019-25495
osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the reviewsid parameter. Attackers can send GET requests to productreviewswrite.php with malicious reviewsid values using boolean-based SQL...
CVE-2019-25495 osCommerce 2.3.4.1 SQL Injection via reviews_id Parameter
osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the reviewsid parameter. Attackers can send GET requests to productreviewswrite.php with malicious reviewsid values using boolean-based SQL...
CVE-2019-25495
osCommerce 2.3.4.1 contains a SQL injection vulnerability exploitable via the reviews_id parameter in product_reviews_write.php. Unauthenticated attackers can craft GET requests with boolean-based payloads to influence database queries and potentially exfiltrate data. CVSS vectors indicate high i...
osCommerce SQL注入漏洞
osCommerce is a set of open-source e-commerce solutions developed by osCommerce Inc., licensed under the GNU GPL. Version 2.3.4.1 of osCommerce contains a SQL injection vulnerability. This vulnerability stems from the reviewsid parameter, which allows for SQL injections, potentially enabling...
PT-2026-22363
osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the reviews id parameter. Attackers can send GET requests to product reviews write.php with malicious reviews id values using boolean-based...
PT-2026-22364
osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the products id parameter. Attackers can modify the products id value in product info.php requests and append boolean-based SQL injection...
osCommerce SQL注入漏洞
osCommerce is a set of open-source e-commerce solutions based on the GNU GPL license, developed by the osCommerce company. Version 2.3.4.1 of osCommerce contains a SQL injection vulnerability. This vulnerability stems from the currency parameter, which allows for SQL injections, potentially...
osCommerce SQL注入漏洞
osCommerce is a set of open-source e-commerce solutions developed by the osCommerce company, licensed under the GNU GPL. Version 2.3.4.1 of osCommerce contains a SQL injection vulnerability. This vulnerability stems from the productsid parameter, which allows for SQL injections, potentially...
PT-2026-22365
osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the currency parameter. Attackers can send GET requests to shopping cart.php with malicious currency values using boolean-based SQL injectio...
CVE-2020-12058
Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/orderstatus.php, catalog/admin/taxrates.php, catalog/admin/languages.php,...
Exploits
osCommerce 2.3.4.1 - Remote Code Execution ---...
VulnCheck KEV: CVE-2018-25114
A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and missing authentication in the installer workflow. By default, the /install/ directory remains accessible after installation. An unauthenticated attacker can...
EUVD-2012-0348
Malware in sbrugna...
EUVD-2018-21601
Malware in sbrugna...