oscommerce2 vulnerabilities

Latest oscommerce2 CVEs

Newest publication first

1. CVE-2026-105226 osCommerce osCommerce2 Newsletter Management newsletters.php include code injection

   Published 2026-10-05

   Medium·CVSS 5.1 EPSS 0.25%

   A security flaw has been discovered in osCommerce osCommerce2 up to 2.3.4.1. This vulnerability affects the function include of the file admin/newsletters.php of the component Newsletter Management. Performing a manipulation of the argument module results in code injection. The a...

2. CVE-2026-105225 osCommerce osCommerce2 Payment payment.php include code injection

   Published 2026-10-05

   Medium·CVSS 4.8 EPSS 0.19%

   A vulnerability was identified in osCommerce osCommerce2 up to 2.3.4.1. This affects the function include of the file includes/classes/payment.php of the component Payment Page. Such manipulation of the argument MODULE_PAYMENT_INSTALLED leads to code injection. The attack can be...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.