Vulnerabilities > Oscommerce > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-09-30 | CVE-2023-43709 | Cross-site Scripting vulnerability in Oscommerce 4.12.56860 Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "configuration_title[1](MODULE)" parameter, potentially leading to unauthorized execution of scripts within a user's web browser. | 5.4 |
| 2023-09-30 | CVE-2023-43710 | Cross-site Scripting vulnerability in Oscommerce 4.12.56860 Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "configuration_title[1][MODULE_SHIPPING_PERCENT_TEXT_TITLE]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser. | 5.4 |
| 2023-09-30 | CVE-2023-43711 | Cross-site Scripting vulnerability in Oscommerce 4.12.56860 Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "admin_firstname" parameter, potentially leading to unauthorized execution of scripts within a user's web browser. | 5.4 |
| 2023-09-30 | CVE-2023-43702 | Cross-site Scripting vulnerability in Oscommerce 4.12.56860 Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "tracking_number" parameter, potentially leading to unauthorized execution of scripts within a user's web browser. | 5.4 |
| 2023-09-30 | CVE-2023-43703 | Cross-site Scripting vulnerability in Oscommerce 4.12.56860 Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "product_info[][name]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser. | 5.4 |
| 2023-09-30 | CVE-2023-43704 | Cross-site Scripting vulnerability in Oscommerce 4.12.56860 Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "title" parameter, potentially leading to unauthorized execution of scripts within a user's web browser. | 5.4 |
| 2023-09-30 | CVE-2023-43705 | Cross-site Scripting vulnerability in Oscommerce 4.12.56860 Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "translation_value[1]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser. | 5.4 |
| 2023-09-30 | CVE-2023-43706 | Cross-site Scripting vulnerability in Oscommerce 4.12.56860 Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "email_templates_key" parameter, potentially leading to unauthorized execution of scripts within a user's web browser. | 5.4 |
| 2020-10-28 | CVE-2020-27975 | Cross-Site Request Forgery (CSRF) vulnerability in Oscommerce osCommerce Phoenix CE before 1.0.5.4 allows admin/define_language.php CSRF. | 6.8 |
| 2020-09-03 | CVE-2020-12058 | Cross-site Scripting vulnerability in Oscommerce CE Phoenix 1.0.6.0 Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. | 4.3 |