CVE-2026-105226

MediumCVSS 4.7

Published: 05/10/2026(UTC)Updated: 07/10/2026(UTC)Translated: 05/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

15th percentile - higher than 15% of all known CVEs

Summary

Code injection vulnerability in osCommerce2 up to 2.3.4.1. Affects the include function in the file admin/newsletters.php in the Newsletter Management component, where manipulation of the module argument leads to code injection. The attack can be executed remotely, and the exploit is public. The project has not responded.

Risk Assessment

Risk of remote code execution on the server, potentially leading to full system and customer data compromise.

Recommendation

Apply proper filters and input validation for the module argument. Also update the system to the latest version or apply available patches.

Other vulnerabilities in osCommerce2

CVE-2026-105225Medium
Code injection vulnerability in osCommerce2 up to 2.3.4.1. Affects the include function in the file includes/classes/payment.php in the Payment Page component, where manipulation of the MODULE_PAYMENT_INSTALLED argument leads to code injection. The attack can be executed remotely, and the exploit is public. The project has not responded.

Original NVD description (English source)

A security flaw has been discovered in osCommerce osCommerce2 up to 2.3.4.1. This vulnerability affects the function include of the file admin/newsletters.php of the component Newsletter Management. Performing a manipulation of the argument module results in code injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS