CVE Intelligence

Oscommerce Oscommerce vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Oscommerce Oscommerce: 3 record(s), with affected versions and fixes.
cpe:2.3:a:oscommerce:oscommerce

CVE-2019-25497 High · 7.5 CWE-89 Feb 27, 2026
osCommerce 2.3.4.1 SQL Injection via currency Parameter
osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the currency parameter. Attackers can send GET requests to shopping_cart.php with malicious currency values using boolean-based SQL injection payloads to extract sensitive database information.
CVE-2019-25496 High · 7.5 CWE-89 Feb 27, 2026
osCommerce 2.3.4.1 SQL Injection via products_id Parameter
osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the products_id parameter. Attackers can modify the products_id value in product_info.php requests and append boolean-based SQL injection payloads to extract sensitive database information.
CVE-2019-25495 High · 7.5 CWE-89 Feb 27, 2026
osCommerce 2.3.4.1 SQL Injection via reviews_id Parameter
osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the reviews_id parameter. Attackers can send GET requests to product_reviews_write.php with malicious reviews_id values using boolean-based SQL injection payloads to extract sensitive database information.