Oscommerce vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2019-25497 osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through theHigh 8.8 · Feb 27, 2026
• CVE-2019-25496 osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through theHigh 8.8 · Feb 27, 2026
• CVE-2019-25495 osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through theHigh 8.8 · Feb 27, 2026
• CVE-2009-20006 osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility (admin/file_manager.php).Critical 9.3 · Sep 16, 2025
• CVE-2018-25114 A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and missing authentication Critical 9.3 · Jul 23, 2025
• CVE-2024-25415 A remote code execution (RCE) vulnerability in /admin/define_language.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP code via injecting aHigh 7.2 · Feb 15, 2024
• CVE-2023-6579 A vulnerability, which was classified as critical, has been found in osCommerce 4.High 7.3 · Dec 7, 2023
• CVE-2020-23360 oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/admiCritical 9.8 · Jan 27, 2021
• CVE-2020-27976 osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely.Critical 9.8 · Oct 28, 2020
• CVE-2020-27975 osCommerce Phoenix CE before 1.0.5.4 allows admin/define_language.php CSRF.High 8.8 · Oct 28, 2020
• CVE-2018-18573 osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page.High 7.2 · Aug 22, 2019
• CVE-2018-18572 osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page.High 7.2 · Aug 22, 2019
• CVE-2011-4543 Multiple directory traversal vulnerabilities in osCommerce 3.0.2 allow remote attackers to include and execute arbitrary local files via a ..High 7.5 · Dec 5, 2011
• CVE-2009-2039 Unspecified vulnerability in the Luottokunta module before 1.3 for osCommerce has unknown impact and attack vectors related to orders.High 10 · Jun 12, 2009
• CVE-2009-2038 Unspecified vulnerability in the Finnish Bank Payment module 2.2 for osCommerce has unknown impact and attack vectors related to bank charges.High 10 · Jun 12, 2009
• CVE-2008-4765 SQL injection vulnerability in pollBooth.php in osCommerce Poll Booth Add-On 2.0 allows remote attackers to execute arbitrary SQL commands via the pollID parameHigh 7.5 · Oct 27, 2008
• CVE-2008-0719 SQL injection vulnerability in customer_testimonials.php in the Customer Testimonials 3 and 3.1 Addon for osCommerce Online Merchant 2.2 allows remote attackersHigh 7.5 · Feb 11, 2008
• CVE-2007-1477 Directory traversal vulnerability in index.php in PHP Point Of Sale for osCommerce 1.1 allows remote attackers to include and execute arbitrary local files via High 7.5 · Mar 16, 2007
• CVE-2006-6533 Directory traversal vulnerability in admin/templates_boxes_layout.php in osCommerce 3.0a3 allows remote attackers to include and execute arbitrary PHP files viaHigh 7.5 · Dec 13, 2006
• CVE-2006-4297 SQL injection vulnerability in shopping_cart.php in osCommerce before 2.2 Milestone 2 060817 allows remote attackers to execute arbitrary SQL commands via id arHigh 7.5 · Aug 22, 2006
• CVE-2004-2638 The Admin Access With Levels plugin in osCommerce 1.5.1 allows remote attackers to access files in the "admin/" directory by modifying the in_login parameter toHigh 7.5 · Dec 31, 2004
• CVE-2002-1991 PHP file inclusion vulnerability in osCommerce 2.1 execute arbitrary commands via the include_file parameter to include_once.php.High 7.5 · Dec 31, 2002
• CVE-2002-2019 PHP remote file inclusion vulnerability in include_once.php in osCommerce (a.k.a.High 7.5 · Dec 31, 2002