CVE-2019-25497: Improper Neutralization of Special Elements used in an SQL Command

osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the currency parameter. Attackers can send GET requests to shoppingcart.php with malicious currency values using boolean-based SQL injection...

osCSS2 "_ID" parameter Local file inclusion

Advisory: osCSS2 "ID" parameter Local file inclusion Advisory ID: SSCHADV2011-034 Author: Stefan Schurtz Affected Software: Successfully tested on osCSS2 2.1.0 latest version Vendor URL: http://oscss.org/ Vendor Status: Fixed in svn branche 2.1.0 and reported in develop version 2.1.1...

CVE-2008-6985: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in includes/classes/shoppingcart.php in Zen Cart 1.2.0 through 1.3.8a, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter when 1 adding or 2 updating the shopping cart...

Session fixation

Session fixation vulnerability in shoppingcart.php in xt:Commerce 3.0.4 and earlier allows remote attackers to hijack web sessions by setting the XTCsid parameter...

CVE-2008-6045: Improper Authentication

Session fixation vulnerability in shoppingcart.php in xt:Commerce 3.0.4 and earlier allows remote attackers to hijack web sessions by setting the XTCsid parameter...

CVE-2006-4297

CVE-2006-4297 is anSQL injection in osCommerce's shopping_cart.php (before 2.2 Milestone 2 060817). The vulnerability allows remote attackers to execute arbitrary SQL via id array parameters. AV:N/AC:L/Au:N/C:P/I:P/A:P (CVSSv2 base 7.5) per NVD; impact is partial on confidentiality, integrity, an...

CVE-2006-4297: Undefined Security Weakness

SQL injection vulnerability in shoppingcart.php in osCommerce before 2.2 Milestone 2 060817 allows remote attackers to execute arbitrary SQL commands via id array parameters...