CVE-2026-105225: osCommerce osCommerce2 Payment payment.php include code injection
Published Oct 5, 2026
·Updated
A vulnerability was identified in osCommerce osCommerce2 up to 2.3.4.1. This affects the function include of the file includes/classes/payment.php of the component Payment Page. Such manipulation of the argument MODULEPAYMENTINSTALLED leads to code injection. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
1 affected component
osCommerce osCommerce2<=2.3.4.1
Event History
Oct 5, 2026
CVE Published
via MITRE·04:15 AM
Data Sourced
via MITRE·04:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access and conditions are required to exploit this issue?
The CVSS vector indicates that exploitation is network-accessible and low complexity, but requires high privileges and user interaction. The vulnerability affects the Payment Page's handling of the MODULE_PAYMENT_INSTALLED argument.