CVE-2025-40674

Reflected Cross-Site Scripting (XSS) in osCommerce v4. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the name of any parameter in /watch/en/about-us. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.

• CWE-79

• https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-oscommerce

Published

Jun 17, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-40669Incorrect authorization vulnerability in TCMAN's GIM v11. Th…6.5
• CVE-2025-4067A vulnerability classified as critical has been found in Scr…6.9
• CVE-2025-40670Incorrect authorization vulnerability in TCMAN's GIM v11. Th…8.8
• CVE-2025-40671SQL injection vulnerability in AES Multimedia's Gestnet v1.0…9.3
• CVE-2025-40672A Privilege Escalation vulnerability has been found in Panlo…8.5
• CVE-2025-40673A Missing Authorization vulnerability has been found in Dino…5.3
• CVE-2025-40675A Reflected Cross-Site Scripting (XSS) vulnerability has bee…6.1
• CVE-2025-40676Insecure Direct Object Reference (IDOR) in Negotiator v3.15.…5.3
• CVE-2025-40677SQL injection vulnerability in Summar Software´s Portal del …8.7
• CVE-2025-40678Unrestricted upload vulnerability for dangerous file types o…5.3
• CVE-2025-40679HTML Injection vulnerability in Isshue by Bdtask, consist…5.1
• CVE-2025-4068A vulnerability classified as critical was found in code-pro…7.8