Loading vulnerability details…
CVSS v3.1
6.6
EPSS
0.31%
Published
Mar 21, 2024
Modified
Jun 27, 2025
Public PoC / Exploit (1)
All weaponized →Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.
Description
An issue was discovered in osCommerce v4, allows local attackers to bypass file upload restrictions and execute arbitrary code via administrator profile photo upload feature.
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:LWeaknesses (CWE)
Affected Products (1)
References (4)