PT-2022-22632 · Unknown · Oscommerce

Name of the Vulnerable Software and Affected Versions: osCommerce2 versions prior to 2.3.4.1 Description: The issue is related to a cross-site scripting XSS vulnerability. This vulnerability can be exploited via the tep db error function. Recommendations: For versions prior to 2.3.4.1, update to...

XOS Shop 1.0.9 - 'Multiple' Arbitrary File Deletion (Authenticated)

Exploit Title: XOS Shop 1.0.9 - 'Multiple' Arbitrary File Deletion Authenticated Date: 2021-07-25 Exploit Author: faisalfs10x https://github.com/faisalfs10x Vendor Homepage: https://xos-shop.com Software Link: https://github.com/XOS-Shop/xosshopsystem/releases/tag/v1.0.9 Version: 1.0.9 Tested on:...

XOS Shop 1.0.9 - (Multiple) Arbitrary File Deletion (Authenticated) Vulnerability

Exploit Title: XOS Shop 1.0.9 - 'Multiple' Arbitrary File Deletion Authenticated Exploit Author: faisalfs10x https://github.com/faisalfs10x Vendor Homepage: https://xos-shop.com Software Link: https://github.com/XOS-Shop/xosshopsystem/releases/tag/v1.0.9 Version: 1.0.9 Tested on: Windows 10, XAMP...

osCommerce 2.3.4.1 RCE

Remote Code Execution in osCommerce Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

osCommerce 2.3.4.1 Remote Code Execution

Exploit Title: osCommerce 2.3.4.1 - Remote Code Execution 2 Vulnerability: Remote Command Execution when /install directory wasn't removed by the admin Exploit: Exploiting the install.php finish process by injecting php payload into the dbdatabase parameter & read the system command output from...

osCommerce 2.3.4.1 - Remote Code Execution Exploit (2)

Exploit Title: osCommerce 2.3.4.1 - Remote Code Execution 2 Vulnerability: Remote Command Execution when /install directory wasn't removed by the admin Exploit: Exploiting the install.php finish process by injecting php payload into the dbdatabase parameter & read the system command output from...

osCommerce 2.3.4.1 - Remote Code Execution (2)

Exploit Title: osCommerce 2.3.4.1 - Remote Code Execution 2 Vulnerability: Remote Command Execution when /install directory wasn't removed by the admin Exploit: Exploiting the install.php finish process by injecting php payload into the dbdatabase parameter & read the system command output from...

CVE-2020-23360

oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/admin/administrators.php and /catalog/passwordreset.php...

CVE-2020-23360

oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/admin/administrators.php and /catalog/passwordreset.php...

Design/Logic Flaw

oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/admin/administrators.php and /catalog/passwordreset.php...

CVE-2020-23360

osCommerce v2.3.4.1 contains a functional flaw in the user registration and password rechecking flow where a non-identical password can bypass validation in /catalog/admin/administrators.php and /catalog/password_reset.php. The connected records do not provide additional technical specifics (e.g....

CVE-2020-23360

oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/admin/administrators.php and /catalog/passwordreset.php...

CVE-2020-23360: Incorrect Comparison

oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/admin/administrators.php and /catalog/passwordreset.php...

osCommerce Security Breach

osCommerce is an open source online shopping e-commerce solution based on the GNUGPL license. A security vulnerability exists in oscommerce v2.3.4.1, which stems from a different password can bypass the catalog administrator administrator .php and catalog password reset...

OsCommerce Phoenix CE Command Injection (CVE-2020-27976)

A command injection vulnerability exists in OsCommerce Phoenix CE. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

osCommerce cross-site scripting vulnerability (CNVD-2020-67635)

OsCommerce is an e-commerce and online store management software program. A cross-site scripting vulnerability exists in osCommerce 2.3.4.1. An attacker can exploit this vulnerability via the header section of a newsletter to conduct a cross-site scripting attack...

CVE-2020-29070

osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters...

CVE-2020-29070

osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters...

Design/Logic Flaw

osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters...

CVE-2020-29070

CVE-2020-29070 affects osCommerce 2.3.4.1. The vulnerability is a cross-site scripting (XSS) issue exploitable when an authenticated user enters an XSS payload into the title field of newsletters. No explicit exploit details or fixes are provided in the connected documents. The available sources ...