Approved changes feed: RSS · Atom
cpe:2.3:a:oscmax:oscmax:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Oscmax (56ea799a-f4a6-533b-8180-d98314cedb64) |
|---|---|
| Product | Oscmax (88dcb679-1ffb-5e07-b76f-337979a64b68) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:bitbucket/oscmax/oscmax2 |
purl2cpe | 2026-06-01 10:16:03.764731 |
pkg:github/oscmax/oscmax2 |
purl2cpe | 2026-06-01 10:16:03.764734 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2012-6691 |
vulnerable | 2026-06-08 05:03:01.564204 |
Details available
Multiple cross-site request forgery (CSRF) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) status parameter to admin/stats_monthly_sales.php or (2) country parameter in a process action to admin/create_account_process.php.
Published: 2015-05-20T18:00:00.000Z
Updated: 2024-08-06T21:36:02.322Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-1665 |
vulnerable | 2026-06-08 05:00:50.248358 |
Details available
Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow (1) remote attackers to execute arbitrary SQL commands via the username parameter in a process action to admin/login.php or (2) remote administrators to execute arbitrary SQL commands via the status parameter to admin/stats_monthly_sales.php or (3) country parameter in a process action to admin/create_account_process.php.
Published: 2015-05-20T18:00:00.000Z
Updated: 2024-08-06T19:01:02.941Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-1664 |
vulnerable | 2026-06-08 05:00:50.247901 |
Details available
Multiple cross-site scripting (XSS) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter in a process action to admin/login.php; (2) pageTitle, (3) current_product_id, or (4) cPath parameter to admin/new_attributes_include.php; (5) sb_id, (6) sb_key, (7) gc_id, (8) gc_key, or (9) path parameter to admin/htaccess.php; (10) title parameter to admin/information_form.php; (11) search parameter to admin/xsell.php; (12) gross or (13) max parameter to admin/stats_products_purchased.php; (14) status parameter to admin/stats_monthly_sales.php; (15) sorted parameter to admin/stats_customers.php; (16) information_id parameter to /admin/information_manager.php; or (17) zID parameter to /admin/geo_zones.php.
Published: 2015-05-20T18:00:00.000Z
Updated: 2024-08-06T19:01:02.908Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.