CVE-2012-1792

OSCommerce Online Merchant 3.0.2 has a documented XSS vulnerability in the installer path: DBCheck.php during installation, where the name parameter to oscommerce/index.php is not properly sanitized in an error message, allowing injection of arbitrary script/HTML. The root cause is improper handl...

CVE-2012-2935

CVE-2012-2935 describes a cross-site scripting (XSS) vulnerability in OSCommerce Online Merchant 3.0.2. The flaw affects the file path OSCommerce/OM/Core/Site/Shop/Application/Checkout/pages/main.php, where a crafted value_title parameter can inject arbitrary web script/HTML. This is the checkout...