CVE-2018-18573

7.2 highEPSS 2.6%

High (7.2) in oscommerce oscommerce. EPSS 2.6% chance of exploitation in the next 30 days.

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated administrators can upload new '.htaccess' files (e.g., omitting .php) and subsequently achieve arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=new_product URI.

Severity

CVSS 3.0

7.2 high

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2019-08-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

oscommerce:oscommerce

References

https://github.com/osCommerce/oscommerce2/issues/631
https://github.com/osCommerce/oscommerce2/issues/631

Check your stack JSON