CVE-2026-105225Medium· 4.3▾ TwilightPoC availableA vulnerability was identified in osCommerce osCommerce2 up to 2.3.4.1. This affects the function include of the file includes/classes/payment.php of the component Payment Page. Such manipulation of the argument MODULE_PAYMENT_INSTALLED …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 23.7 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Exploit / PoC code exists
Last analysed / modified upstream
A vulnerability was identified in osCommerce osCommerce2 up to 2.3.4.1. This affects the function include of the file includes/classes/payment.php of the component Payment Page. Such manipulation of the argument MODULE_PAYMENT_INSTALLED leads to code injection. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105226Medium· 4.7A security flaw has been discovered in osCommerce osCommerce2 up to 2.3.4.1
CVE-2025-10097Medium· 6.3A vulnerability was identified in SimStudioAI sim up to 1.0.0
CVE-2023-29383Low· 3.3In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger)
CVE-2023-27533High· 8.8A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation
CVE-2023-4548Medium· 6.3A vulnerability has been found in SPA-Cart eCommerce CMS 1.9.0.3
CVE-2025-10012Medium· 6.3A security vulnerability has been detected in Portabilis i-Educar up to 2.10