GCVE - cpe:2.3:a:oscommerce:oscommerce:2.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:oscommerce:oscommerce:2.1:*:*:*:*:*:*:*

part: a version: 2.1 update: *

Vendor	Oscommerce (`098fcb3a-981f-5eec-92bc-f7a3c45bbae2`)
Product	Oscommerce (`f05e8607-2cd4-5ed2-8937-7df3644c7cce`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/oscommerce/oscommerce`	purl2cpe	2026-06-01 10:12:48.795687
`pkg:github/oscommerce/oscommerce2`	purl2cpe	2026-06-01 10:12:48.795689

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2006-5190`	vulnerable	2026-06-08 04:49:19.921318	Details available Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in the (a) banner_manager.php, (b) banner_statistics.php, (c) countries.php, (d) currencies.php, (e) languages.php, (f) manufacturers.php, (g) newsletters.php, (h) orders_status.php, (i) products_attributes.php, (j) products_expected.php, (k) reviews.php, (l) specials.php, (m) stats_products_purchased.php, (n) stats_products_viewed.php, (o) tax_classes.php, (p) tax_rates.php, or (q) zones.php scripts in /admin, and the (2) zpage parameter in (r) admin/geo_zones.php. Published: 2006-10-06T19:00:00.000Z Updated: 2024-08-07T19:41:05.006Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/28750/ http://www.osvdb.org/29801 https://www.exploit-db.com/exploits/28746/ http://www.osvdb.org/29803 http://www.vupen.com/english/advisories/2006/3917	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-1951`	vulnerable	2026-06-08 04:48:27.955450	Details available Multiple HTTP Response Splitting vulnerabilities in osCommerce 2.2 Milestone 2 and earlier allow remote attackers to spoof web content and poison web caches via hex-encoded CRLF ("%0d%0a") sequences in the (1) products_id or (2) pid parameter to index.php or (3) goto parameter to banner.php. Published: 2005-06-14T04:00:00.000Z Updated: 2024-08-07T22:06:57.813Z Open on db.gcve.eu Reference links http://marc.info/?l=bugtraq&m=111842744205117&w=2 http://secunia.com/advisories/15670 http://marc.info/?l=bugtraq&m=111936255011735&w=2 http://www.gulftech.org/?node=research&article_id=00080-06102005 http://www.securityfocus.com/bid/13979	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2004-2021`	vulnerable	2026-06-08 04:48:08.319554	Details available Directory traversal vulnerability in file_manager.php in osCommerce 2.2 allows remote attackers to view arbitrary files via a .. (dot dot) in the filename argument. Published: 2005-05-10T04:00:00.000Z Updated: 2024-08-08T01:15:01.145Z Open on db.gcve.eu Reference links http://securitytracker.com/id?1010176 http://marc.info/?l=bugtraq&m=108482902101519&w=2 http://www.excluded.org/advisories/advisory13.txt http://www.osvdb.org/6308 https://exchange.xforce.ibmcloud.com/vulnerabilities/16174	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2002-2019`	vulnerable	2026-06-08 04:47:18.893380	Details available PHP remote file inclusion vulnerability in include_once.php in osCommerce (a.k.a. Exchange Project) 2.1 allows remote attackers to execute arbitrary PHP code via the include_file parameter. Published: 2005-07-14T04:00:00.000Z Updated: 2024-09-16T20:07:23.422Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/5037 http://archives.neohapsis.com/archives/bugtraq/2002-06/0188.html http://www.oscommerce.com/about.php/news%2C72 http://www.iss.net/security_center/static/9369.php	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2002-1991`	vulnerable	2026-06-08 04:47:18.746437	Details available PHP file inclusion vulnerability in osCommerce 2.1 execute arbitrary commands via the include_file parameter to include_once.php. Published: 2005-07-14T04:00:00.000Z Updated: 2024-08-08T03:43:33.608Z Open on db.gcve.eu Reference links http://online.securityfocus.com/archive/1/277312 http://www.securityfocus.com/bid/5037 http://www.iss.net/security_center/static/9369.php http://www.oscommerce.com/about.php/news%2C72	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.