CVE-2026-105225

A vulnerability was identified in osCommerce osCommerce2 up to 2.3.4.1. This affects the function include of the file includes/classes/payment.php of the component Payment Page. Such manipulation of the argument MODULE_PAYMENT_INSTALLED leads to code injection. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

• CWE-74
• CWE-94

• https://github.com/osCommerce/oscommerce2/
• https://github.com/osCommerce/oscommerce2/issues/677
• https://vuldb.com/cve/CVE-2026-105225
• https://vuldb.com/submit/971046
• https://vuldb.com/vuln/413427
• https://vuldb.com/vuln/413427/cti

Published

Oct 5, 2026

Last Modified

Oct 5, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10522The MemberHero WordPress plugin through 6.9 does not restri…9.8
• CVE-2026-105220Twine 2 desktop through 2.12.0 contains a cross-site scripti…7.8
• CVE-2026-105221The gist RubyGem before 6.1.0 contains an improper certifica…7.4
• CVE-2026-105222The alexpechkarev/google-maps Laravel package through 12.16 …7.4
• CVE-2026-105223maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS c…7.4
• CVE-2026-105224YesWiki before 4.6.7 contains a cross-site scripting vulnera…5.4
• CVE-2026-105226A security flaw has been discovered in osCommerce osCommerce…4.7
• CVE-2026-105229A weakness has been identified in kishor-23 food-waste-manag…7.3
• CVE-2026-10523An Authentication Bypass vulnerability (CWE-288) in Ivanti S…9.8
• CVE-2026-105230A security vulnerability has been detected in kishor-23 food…7.3
• CVE-2026-105231A vulnerability was detected in kishor-23 food-waste-managem…7.3
• CVE-2026-105232A flaw has been found in kishor-23 food-waste-management-sys…7.3