Vulnerabilities > Oscommerce > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-09-30 | CVE-2023-43709 | Unspecified vulnerability in Oscommerce 4.12.56860 Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "configuration_title[1](MODULE)" parameter, potentially leading to unauthorized execution of scripts within a user's web browser. | 5.4 |
| 2023-09-30 | CVE-2023-43710 | Unspecified vulnerability in Oscommerce 4.12.56860 Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "configuration_title[1][MODULE_SHIPPING_PERCENT_TEXT_TITLE]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser. | 5.4 |
| 2023-09-30 | CVE-2023-43711 | Unspecified vulnerability in Oscommerce 4.12.56860 Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "admin_firstname" parameter, potentially leading to unauthorized execution of scripts within a user's web browser. | 5.4 |
| 2023-09-30 | CVE-2023-43702 | Unspecified vulnerability in Oscommerce 4.12.56860 Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "tracking_number" parameter, potentially leading to unauthorized execution of scripts within a user's web browser. | 5.4 |
| 2023-09-30 | CVE-2023-43703 | Unspecified vulnerability in Oscommerce 4.12.56860 Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "product_info[][name]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser. | 5.4 |
| 2023-09-30 | CVE-2023-43704 | Unspecified vulnerability in Oscommerce 4.12.56860 Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "title" parameter, potentially leading to unauthorized execution of scripts within a user's web browser. | 5.4 |
| 2023-09-30 | CVE-2023-43705 | Unspecified vulnerability in Oscommerce 4.12.56860 Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "translation_value[1]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser. | 5.4 |
| 2023-09-30 | CVE-2023-43706 | Unspecified vulnerability in Oscommerce 4.12.56860 Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "email_templates_key" parameter, potentially leading to unauthorized execution of scripts within a user's web browser. | 5.4 |
| 2022-08-18 | CVE-2022-35212 | Cross-site Scripting vulnerability in Oscommerce osCommerce2 before v2.3.4.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the function tep_db_error(). | 6.1 |
| 2020-11-25 | CVE-2020-29070 | Cross-site Scripting vulnerability in Oscommerce 2.3.4.1 osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters. | 4.8 |