Vulnerability Database

314,486

Total vulnerabilities in the database

CVE-2018-18573

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated administrators can upload new '.htaccess' files (e.g., omitting .php) and subsequently achieve arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=new_product URI.

  • Published: Aug 22, 2019
  • Updated: Nov 9, 2025
  • CVE: CVE-2018-18573
  • Severity: Medium
  • Exploit:

CVSS v2:

  • Severity: Medium
  • Score: 6.5
  • AV:N/AC:L/Au:S/C:P/I:P/A:P

CWEs:

Software From Fixed in
oscommerce / oscommerce 2.3.4.1 2.3.4.1.x