CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-35212
https://notcve.org/view.php?id=CVE-2022-35212
osCommerce2 before v2.3.4.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the function tep_db_error(). Se ha detectado que osCommerce2 versiones anteriores a v2.3.4.1, contenía una vulnerabilidad de tipo cross-site scripting (XSS) por medio de la función tep_db_error(). • https://forums.oscommerce.com/topic/497119-potencial-xss-vulnerability/?tab=comments#comment-1823082 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 0%CPEs: 1EXPL: 0CVE-2015-2965
https://notcve.org/view.php?id=CVE-2015-2965
Directory traversal vulnerability in osCommerce Japanese 2.2ms1j-R8 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors. Vulnerabilidad de salto de directorio en osCommerce Japanese 2.2ms1j-R8 y anteriores permite a administradores remotos autenticados leer ficheros arbitrarios a través de vectores no especificados. • http://jvn.jp/en/jp/JVN96312698/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2015-000091 http://www.bitscope.co.jp/tep/news.html http://www.securityfocus.com/bid/75472 http://www.securitytracker.com/id/1032736 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 3%CPEs: 11EXPL: 21CVE-2006-5190 – osCommerce 2.2 - '/admin/banner_manager.php?page' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2006-5190
Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in the (a) banner_manager.php, (b) banner_statistics.php, (c) countries.php, (d) currencies.php, (e) languages.php, (f) manufacturers.php, (g) newsletters.php, (h) orders_status.php, (i) products_attributes.php, (j) products_expected.php, (k) reviews.php, (l) specials.php, (m) stats_products_purchased.php, (n) stats_products_viewed.php, (o) tax_classes.php, (p) tax_rates.php, or (q) zones.php scripts in /admin, and the (2) zpage parameter in (r) admin/geo_zones.php. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados en osCommerce 2.2 Milestone 2 Update 060817 permite a un atacante remoto inyectar secuencias de comandos web o HTML de su elección a través del parámetro (1) page en las secuencias de comandos (a) banner_manager.php, (b) banner_statistics.php, (c) countries.php, (d) currencies.php, (e) languages.php, (f) manufacturers.php, (g) newsletters.php, (h) orders_status.php, (i) products_attributes.php, (j) products_expected.php, (k) reviews.php, (l) specials.php, (m) stats_products_purchased.php, (n) stats_products_viewed.php, (o) tax_classes.php, (p) tax_rates.php, o (q) zones.php en /admin, y el (2) parámetro zpage en (r) admin/geo_zones.php. • https://www.exploit-db.com/exploits/28743 https://www.exploit-db.com/exploits/28745 https://www.exploit-db.com/exploits/28746 https://www.exploit-db.com/exploits/28744 https://www.exploit-db.com/exploits/28747 https://www.exploit-db.com/exploits/28748 https://www.exploit-db.com/exploits/28749 https://www.exploit-db.com/exploits/28750 https://www.exploit-db.com/exploits/28751 https://www.exploit-db.com/exploits/28752 https://www.exploit-db.com/exploits/28753 •
CVSS: 7.5EPSS: 1%CPEs: 4EXPL: 0CVE-2005-4677
https://notcve.org/view.php?id=CVE-2005-4677
SQL injection vulnerability in additional_images.php (aka the Additional Images module) before 1.14 in osCommerce allows remote attackers to execute arbitrary SQL commands via the products_id parameter to product_info.php. • http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0124.html http://secunia.com/advisories/17082 http://www.oscommerce.com/community/contributions%2C1032 http://www.osvdb.org/19874 http://www.securityfocus.com/bid/15023 http://www.vupen.com/english/advisories/2005/1974 https://exchange.xforce.ibmcloud.com/vulnerabilities/22528 •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2004-2638
https://notcve.org/view.php?id=CVE-2004-2638
The Admin Access With Levels plugin in osCommerce 1.5.1 allows remote attackers to access files in the "admin/" directory by modifying the in_login parameter to a non-zero value. • http://secunia.com/advisories/11473 http://secwatch.org/advisories/1007857 http://www.osvdb.org/5717 http://www.securityfocus.com/bid/10235 https://exchange.xforce.ibmcloud.com/vulnerabilities/16009 •