CVE-2026-105225

MediumCVSS 4.3

Published: 05/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 05/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

Code injection vulnerability in osCommerce2 up to 2.3.4.1. Affects the include function in the file includes/classes/payment.php in the Payment Page component, where manipulation of the MODULE_PAYMENT_INSTALLED argument leads to code injection. The attack can be executed remotely, and the exploit is public. The project has not responded.

Risk Assessment

Risk of remote code execution, potentially leading to system takeover and payment data compromise.

Recommendation

Apply proper filters and input validation for the MODULE_PAYMENT_INSTALLED argument. Also update the system to the latest version or apply available patches.

Other vulnerabilities in osCommerce2

CVE-2026-105226Medium
Code injection vulnerability in osCommerce2 up to 2.3.4.1. Affects the include function in the file admin/newsletters.php in the Newsletter Management component, where manipulation of the module argument leads to code injection. The attack can be executed remotely, and the exploit is public. The project has not responded.

Original NVD description (English source)

A vulnerability was identified in osCommerce osCommerce2 up to 2.3.4.1. This affects the function include of the file includes/classes/payment.php of the component Payment Page. Such manipulation of the argument MODULE_PAYMENT_INSTALLED leads to code injection. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS