CVE-2026-18592

MediumCVSS 4.7

Published: 03/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 03/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

A security flaw has been discovered in osCommerce 4.14.63493. Affected is the function EmailController of the file app/lib/backend/controllers/EmailController.php of the component Email Template Configuration. Manipulation of the argument email_templates_key results in SQL injection. The attack is possible remotely and the exploit has been released.

Risk Assessment

The risk is the ability to execute arbitrary SQL queries, potentially leading to data leakage, modification, or database deletion.

Recommendation

It is recommended to immediately update to a patched version or apply temporary mitigations such as input validation.

Other vulnerabilities in osCommerce

CVE-2009-20006Critical
osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility (admin/file_manager.php). The interface allows file uploads and edits without sufficient input validation or access control, enabling an unauthenticated attacker to upload a .php file containing arbitrary code, which is then executed by the server.

Original NVD description (English source)

A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/EmailController.php of the component Email Template Configuration. Performing a manipulation of the argument email_templates_key results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS