How many osCommerce online merchant CVEs are in CISA KEV?

None of osCommerce online merchant's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of osCommerce online merchant are affected?

11 distinct osCommerce online merchant versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in osCommerce online merchant CVEs?

osCommerce online merchant's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-94 (Improper Control of Generation of Code ('Code Injection')).

How many critical osCommerce online merchant vulnerabilities are there?

osCommerce online merchant has 1 critical and 1 high-severity CVEs.

What is the average severity of osCommerce online merchant CVEs?

The average CVSS base score across osCommerce online merchant's scored CVEs is 5.3.

RadicalNotion.AI

Log in Create an account

osCommerce

11 CVEs

osCommerce online merchant Vulnerabilities

Name: osCommerce online merchant vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for online merchant by osCommerce.

11

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

5

Public exploits

PoC or exploit code

5.3

Avg CVSS

2008–2025

Last updated July 23, 2025

Overview

osCommerce online merchant has 11 published CVE records since 2008, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 5 have a known public exploit. The average CVSS base score across scored CVEs is 5.3. Affected platforms include internet explorer.

Severity and exploitation

How the CVSS severity of osCommerce online merchant's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical1

High1

Medium8

Low1

In CISA’s Known Exploited Vulnerabilities catalog

0

None of osCommerce online merchant's CVEs are currently listed in CISA's KEV catalog.

Public exploits

5

5 of osCommerce online merchant's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every osCommerce online merchant version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

2.3.4.1 <= v <= 2.3.4.14 CVEs
2.2 <= v <= 2.23 CVEs
2.3.0 <= v <= 2.3.03 CVEs
2.3.1 <= v <= 2.3.13 CVEs
<= 3.0.22 CVEs
<= 2.3.01 CVE
<= 2.3.31 CVE
<= 2.3.3.41 CVE
>= 2.3.4.11 CVE
2.3.2 <= v <= 2.3.21 CVE
3.0.2 <= v <= 3.0.21 CVE

Find a version

11 CVEs

Sort

osCommerce 2.3.4.1 Installer Unauthenticated Configuration File Injection PHP Code Execution
CVE-2018-25114
Public exploit
CWE-94
Critical · CVSS 9.3
EPSS 4.5% (91th pct)2025-07-23
Medium vulnerability · 2018-11-06
CVE-2018-18966
Medium · CVSS 4.9
EPSS 1.0% (63th pct)2018-11-06
Medium vulnerability · 2018-11-06
CVE-2018-18965
Medium · CVSS 4.9
EPSS 1.0% (63th pct)2018-11-06
Medium vulnerability · 2018-11-06
CVE-2018-18964
Medium · CVSS 4.9
EPSS 1.0% (63th pct)2018-11-06
Medium vulnerability · 2015-01-13
CVE-2014-10033
Public exploit
Patch
CWE-89
Medium · CVSS 6.5
EPSS 1.8% (78th pct)2015-01-13
Medium vulnerability · 2012-09-19
CVE-2012-2991
Medium · CVSS 5.0
EPSS 1.1% (66th pct)2012-09-19
Medium vulnerability · 2012-05-27
CVE-2012-2935
Patch
CWE-79
Medium · CVSS 4.3
EPSS 0.9% (60th pct)2012-05-27
Low vulnerability · 2012-05-27
CVE-2012-1792
Public exploit
CWE-79
Low · CVSS 2.6
EPSS 0.9% (58th pct)2012-05-27
Medium vulnerability · 2012-02-14
CVE-2012-1059
Public exploit
Patch
CWE-79
Medium · CVSS 4.3
EPSS 3.4% (89th pct)2012-02-14
Medium vulnerability · 2012-01-26
CVE-2012-0312CWE-79
Medium · CVSS 4.3
EPSS 1.0% (63th pct)2012-01-26
High vulnerability · 2008-10-28
CVE-2008-4765
Public exploit
CWE-89
High · CVSS 7.5
EPSS 1.0% (61th pct)2008-10-28

Common weakness types

The CWE weakness categories most often found in osCommerce online merchant CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many osCommerce online merchant CVEs were published each year.

2008

1

2012

5

2015

1

2018

3

2025

1

Other osCommerce products

Browse vulnerabilities for other products by osCommerce.

oscommerce87 CVEs Os Commerce36 CVEs oscommerce213 CVEs ce phoenix4 CVEs customer testimonials1 CVEs finnish bank payment1 CVEs luottokunta1 CVEs osc2nuke1 CVEs

All osCommerce vulnerabilities

Frequently asked questions

Common questions about osCommerce online merchant vulnerabilities.

How many CVEs does osCommerce online merchant have?: osCommerce online merchant has 11 published CVE records since 2008.
How many osCommerce online merchant CVEs are in CISA KEV?: None of osCommerce online merchant's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for osCommerce online merchant vulnerabilities?: Yes — 5 of osCommerce online merchant's CVEs have a known public exploit.
Which versions of osCommerce online merchant are affected?: 11 distinct osCommerce online merchant versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in osCommerce online merchant CVEs?: osCommerce online merchant's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-94 (Improper Control of Generation of Code ('Code Injection')).
How many critical osCommerce online merchant vulnerabilities are there?: osCommerce online merchant has 1 critical and 1 high-severity CVEs.
What is the average severity of osCommerce online merchant CVEs?: The average CVSS base score across osCommerce online merchant's scored CVEs is 5.3.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track osCommerce online merchant vulnerabilities

Get an alert for each new osCommerce online merchant CVE, with AI-written analysis and remediation steps.

Create an account See pricing