osCommerce

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:oscommerce:oscommerce:-:*:*:*:*:*:*:*

part: a version: - update: *

VendorOscommerce (098fcb3a-981f-5eec-92bc-f7a3c45bbae2)
ProductOscommerce (f05e8607-2cd4-5ed2-8937-7df3644c7cce)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:github/oscommerce/oscommerce purl2cpe 2026-06-01 10:12:48.795623
pkg:github/oscommerce/oscommerce2 purl2cpe 2026-06-01 10:12:48.795626

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-4348 vulnerable 2026-06-08 06:50:17.559941 osCommerce all-products cross site scripting
MEDIUM (4.3)
A vulnerability, which was classified as problematic, was found in osCommerce 4. Affected is an unknown function of the file /catalog/all-products. The manipulation of the argument cat leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-262488. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2024-04-30T22:00:04.756Z
Updated: 2024-08-01T20:40:46.523Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-22724 vulnerable 2026-06-08 06:29:36.001447 Details available
An issue was discovered in osCommerce v4, allows local attackers to bypass file upload restrictions and execute arbitrary code via administrator profile photo upload feature.
Published: 2024-03-21T00:00:00.000Z
Updated: 2024-08-06T14:32:24.651Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2012-5798 vulnerable 2026-06-08 05:02:58.260132 Details available
The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Published: 2012-11-04T22:00:00.000Z
Updated: 2024-09-17T02:06:49.770Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2012-5797 vulnerable 2026-06-08 05:02:58.259804 Details available
The PayPal Pro PayFlow module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Published: 2012-11-04T22:00:00.000Z
Updated: 2024-08-06T21:14:16.457Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2012-5796 vulnerable 2026-06-08 05:02:58.256942 Details available
The PayPal Pro module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Published: 2012-11-04T22:00:00.000Z
Updated: 2024-08-06T21:14:16.573Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2012-5795 vulnerable 2026-06-08 05:02:58.256573 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2012-5794 vulnerable 2026-06-08 05:02:58.255264 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2012-5793 vulnerable 2026-06-08 05:02:58.253852 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2012-5792 vulnerable 2026-06-08 05:02:58.251922 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.