[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvz862qjH98oyNYG9IYjUvptPR-GpSLvZ7q1hvnAVCig":3,"g5a-ex:oscommerce\u002Fonline_merchant@*":154,"g5a-family:oscommerce\u002Fonline_merchant":156},{"success":4,"data":5},true,{"product":6,"versions":56,"topVulnerabilitiesByEpss":76,"kevVulnerabilities":132,"seoMetadata":133,"meta":152},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":55},"oscommerce","online_merchant",19,10,0,"2018-11-06",[14,18,20,22,24,27,29,31,33,35,37,39,41,43,45,47,49,51,53],{"version":15,"cve_count":16,"kev_count":11,"has_kev":17},"2.2",3,false,{"version":19,"cve_count":11,"kev_count":11,"has_kev":17},"2.3",{"version":21,"cve_count":16,"kev_count":11,"has_kev":17},"2.3.0",{"version":23,"cve_count":16,"kev_count":11,"has_kev":17},"2.3.1",{"version":25,"cve_count":26,"kev_count":11,"has_kev":17},"2.3.2",1,{"version":28,"cve_count":11,"kev_count":11,"has_kev":17},"2.3.3",{"version":30,"cve_count":11,"kev_count":11,"has_kev":17},"2.3.3.1",{"version":32,"cve_count":11,"kev_count":11,"has_kev":17},"2.3.3.2",{"version":34,"cve_count":11,"kev_count":11,"has_kev":17},"2.3.3.3",{"version":36,"cve_count":11,"kev_count":11,"has_kev":17},"2.3.3.4",{"version":38,"cve_count":11,"kev_count":11,"has_kev":17},"2.3.4",{"version":40,"cve_count":16,"kev_count":11,"has_kev":17},"2.3.4.1",{"version":42,"cve_count":11,"kev_count":11,"has_kev":17},"2.4.0",{"version":44,"cve_count":11,"kev_count":11,"has_kev":17},"2.4.1",{"version":46,"cve_count":11,"kev_count":11,"has_kev":17},"2.4.2",{"version":48,"cve_count":11,"kev_count":11,"has_kev":17},"3.0",{"version":50,"cve_count":11,"kev_count":11,"has_kev":17},"3.0.1",{"version":52,"cve_count":26,"kev_count":11,"has_kev":17},"3.0.2",{"version":54,"cve_count":11,"kev_count":11,"has_kev":17},"4.0","Online Merchant by Oscommerce is a technology product with 19 tracked versions and 10 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75],{"version":15,"cve_count":16,"kev_count":11,"has_kev":17},{"version":19,"cve_count":11,"kev_count":11,"has_kev":17},{"version":21,"cve_count":16,"kev_count":11,"has_kev":17},{"version":23,"cve_count":16,"kev_count":11,"has_kev":17},{"version":25,"cve_count":26,"kev_count":11,"has_kev":17},{"version":28,"cve_count":11,"kev_count":11,"has_kev":17},{"version":30,"cve_count":11,"kev_count":11,"has_kev":17},{"version":32,"cve_count":11,"kev_count":11,"has_kev":17},{"version":34,"cve_count":11,"kev_count":11,"has_kev":17},{"version":36,"cve_count":11,"kev_count":11,"has_kev":17},{"version":38,"cve_count":11,"kev_count":11,"has_kev":17},{"version":40,"cve_count":16,"kev_count":11,"has_kev":17},{"version":42,"cve_count":11,"kev_count":11,"has_kev":17},{"version":44,"cve_count":11,"kev_count":11,"has_kev":17},{"version":46,"cve_count":11,"kev_count":11,"has_kev":17},{"version":48,"cve_count":11,"kev_count":11,"has_kev":17},{"version":50,"cve_count":11,"kev_count":11,"has_kev":17},{"version":52,"cve_count":26,"kev_count":11,"has_kev":17},{"version":54,"cve_count":11,"kev_count":11,"has_kev":17},[77,85,91,97,102,108,111,114,121,126],{"cveId":78,"description":79,"publishedDate":80,"cvssScore":81,"cvssVersion":82,"severity":83,"isKev":17,"epssScore":84},"CVE-2012-1059","Cross-site scripting (XSS) vulnerability in osCommerce\u002FOM\u002FCore\u002FSite\u002FShop\u002FApplication\u002FCart\u002Fpages\u002Fmain.php in OSCommerce Online Merchant 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the value_title parameter, as demonstrated using the \"Front\" field in the shirt module.","2012-02-14",4.3,"v2","Medium",0.03406,{"cveId":86,"description":87,"publishedDate":88,"cvssScore":89,"cvssVersion":82,"severity":83,"isKev":17,"epssScore":90},"CVE-2014-10033","SQL injection vulnerability in the update_zone function in catalog\u002Fadmin\u002Fgeo_zones.php in osCommerce Online Merchant 2.3.3.4 and earlier allows remote administrators to execute arbitrary SQL commands via the zID parameter in a list action.","2015-01-13",6.5,0.01798,{"cveId":92,"description":93,"publishedDate":94,"cvssScore":95,"cvssVersion":82,"severity":83,"isKev":17,"epssScore":96},"CVE-2012-2991","The PayPal (aka MODULE_PAYMENT_PAYPAL_STANDARD) module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self.","2012-09-19",5,0.0114,{"cveId":98,"description":99,"publishedDate":100,"cvssScore":81,"cvssVersion":82,"severity":83,"isKev":17,"epssScore":101},"CVE-2012-0312","Cross-site scripting (XSS) vulnerability in osCommerce 2.2MS1J before R9, and osCommerce Online Merchant before 2.3.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","2012-01-26",0.01042,{"cveId":103,"description":104,"publishedDate":12,"cvssScore":105,"cvssVersion":106,"severity":83,"isKev":17,"epssScore":107},"CVE-2018-18966","osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the \"product\" page. The .htaccess file in catalog\u002Fimages\u002F bans the html extension, but Internet Explorer render HTML elements in a .eml file.",4.9,"v3.0",0.01017,{"cveId":109,"description":110,"publishedDate":12,"cvssScore":105,"cvssVersion":106,"severity":83,"isKev":17,"epssScore":107},"CVE-2018-18964","osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the \"product\" page. The .htaccess file in catalog\u002Fimages\u002F bans the html extension, but there are several extensions in which contained HTML can be executed, such as the svg extension.",{"cveId":112,"description":113,"publishedDate":12,"cvssScore":105,"cvssVersion":106,"severity":83,"isKev":17,"epssScore":107},"CVE-2018-18965","osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the \"product\" page. The .htaccess file in catalog\u002Fimages\u002F bans the html extension, but there are several alternative cases in which HTML can be executed, such as a file with no extension or an unrecognized extension (e.g., the test or test.asdf filename).",{"cveId":115,"description":116,"publishedDate":117,"cvssScore":118,"cvssVersion":82,"severity":119,"isKev":17,"epssScore":120},"CVE-2008-4765","SQL injection vulnerability in pollBooth.php in osCommerce Poll Booth Add-On 2.0 allows remote attackers to execute arbitrary SQL commands via the pollID parameter in a results operation.  NOTE: this issue was disclosed by an unreliable researcher, so it might be incorrect.","2008-10-28",7.5,"High",0.00975,{"cveId":122,"description":123,"publishedDate":124,"cvssScore":81,"cvssVersion":82,"severity":83,"isKev":17,"epssScore":125},"CVE-2012-2935","Cross-site scripting (XSS) vulnerability in osCommerce\u002FOM\u002FCore\u002FSite\u002FShop\u002FApplication\u002FCheckout\u002Fpages\u002Fmain.php in OSCommerce Online Merchant 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the value_title parameter, a different vulnerability than CVE-2012-1059.","2012-05-27",0.00921,{"cveId":127,"description":128,"publishedDate":124,"cvssScore":129,"cvssVersion":82,"severity":130,"isKev":17,"epssScore":131},"CVE-2012-1792","Cross-site scripting (XSS) vulnerability in osCommerce\u002FOM\u002FCore\u002FSite\u002FSetup\u002FApplication\u002FInstall\u002FRPC\u002FDBCheck.php in OSCommerce Online Merchant 3.0.2, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the name parameter to oscommerce\u002Findex.php, which is not properly handled in an error message.  NOTE: this might not be a vulnerability, since the ability to access oscommerce\u002Findex.php during installation may already imply administrator privileges.",2.6,"Low",0.00865,[],{"title":134,"metaDescription":135,"keywords":136,"structuredData":137},"Online Merchant by Oscommerce - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Online Merchant by Oscommerce covering 19 versions with 10 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Online Merchant vulnerabilities, Online Merchant security, Online Merchant CVE, Oscommerce Online Merchant, Online Merchant threat intelligence, Oscommerce security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":138,"@type":139,"name":140,"description":135,"url":141,"manufacturer":142,"applicationCategory":146,"softwareVersion":147,"mainEntity":148},"https:\u002F\u002Fschema.org","SoftwareApplication","Online Merchant","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foscommerce\u002Fonline_merchant",{"@type":143,"name":144,"url":145},"Organization","Oscommerce","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foscommerce","Security Software","19 versions tracked",{"@type":149,"name":150,"description":151,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Online Merchant Security Vulnerabilities","Security vulnerabilities affecting Online Merchant by Oscommerce",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":153,"apiVersion":48},"2026-10-18T22:16:24.004Z",{"rows":155,"total":11,"capped":17,"failed":11},[],[]]