Design/Logic Flaw

osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters...

CVE-2020-29070

CVE-2020-29070 affects osCommerce 2.3.4.1. The vulnerability is a cross-site scripting (XSS) issue exploitable when an authenticated user enters an XSS payload into the title field of newsletters. No explicit exploit details or fixes are provided in the connected documents. The available sources ...

CVE-2020-29070

osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters...

osCommerce 跨站脚本漏洞

OsCommerce is an e-commerce and online store management software program. A cross-site scripting vulnerability exists in osCommerce 2.3.4.1. An attacker can exploit this vulnerability via the header section of a newsletter to conduct a cross-site scripting attack...

osCommerce 2.3.4.1 Cross Site Scripting

Exploit Title: osCommerce 2.3.4.1 - 'title' Persistent Cross-Site Scripting Date: 2020-11-19 Exploit Author: Emre Aslan Vendor Homepage: https://www.oscommerce.com/ Version: 2.3.4.1 Tested on: Windows & XAMPP == Tutorial https://HOST/catalog/admin/newsletters.php?action=new 3- Enter the XSS paylo...

osCommerce 2.3.4.1 - 'title' Persistent Cross-Site Scripting

Exploit Title: osCommerce 2.3.4.1 - 'title' Persistent Cross-Site Scripting Date: 2020-11-19 Exploit Author: Emre Aslan Vendor Homepage: https://www.oscommerce.com/ Version: 2.3.4.1 Tested on: Windows & XAMPP == Tutorial https://HOST/catalog/admin/newsletters.php?action=new 3- Enter the XSS paylo...

Exploit for OS Command Injection in Oscommerce

PoC exploit for CVE-2020-27976, an authenticated remote code exe...

osCommerce Phoenix CE Cross-Site Request Forgery Vulnerability

OsCommerce is an e-commerce and online store management software program.CE Phoenix is the official community version of osCommerce. A cross-site request forgery vulnerability exists in admin/definelanguage.php in osCommerce CE Phoenix versions prior to 1.0.5.4. No details of the vulnerability ar...

osCommerce CE Phoenix OS Command Injection Vulnerability

OsCommerce is an e-commerce and online store management software program.CE Phoenix is the official community version of osCommerce. An OS command injection vulnerability exists in osCommerce CE Phoenix versions prior to 1.0.5.4. An attacker can exploit this vulnerability to execute arbitrary cod...

CVE-2020-27976

osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...

CVE-2020-27975

osCommerce Phoenix CE before 1.0.5.4 allows admin/definelanguage.php CSRF...

CVE-2020-27975

osCommerce Phoenix CE before 1.0.5.4 allows admin/definelanguage.php CSRF...

CVE-2020-27976

osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...

Cross site request forgery (csrf)

osCommerce Phoenix CE before 1.0.5.4 allows admin/definelanguage.php CSRF...

Command injection

osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...

CVE-2020-27975

osCommerce Phoenix CE before 1.0.5.4 allows admin/definelanguage.php CSRF...

CVE-2020-27975

CVE-2020-27975 affects osCommerce Phoenix CE prior to 1.0.5.4, with a Cross-Site Request Forgery in admin/define_language.php. The vulnerability is documented across multiple feeds (NVD entry and Red Hat/CNVD mirrors) as CSRF, indicating that unauthenticated or unintended requests could affect la...

CVE-2020-27976

osCommerce Phoenix CE prior to 1.0.5.4 is affected by a remote OS command injection via admin/mail.php where a from POST parameter can reach the PHP mail function and the sendmail -f option. Root cause is command injection in processing the from parameter, enabling remote code execution per the C...

CVE-2020-27976

osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...

osCommerce cross-site scripting vulnerability (CNVD-2020-67836)

osCommerce is an open source online shopping e-commerce solution based on the GNUGPL license. A cross-site scripting vulnerability exists in osCommerce CE Phoenix versions prior to 1.0.6.0, which stems from a lack of proper validation of client-side data by the WEB application. An attacker can...