← Back to the live CVE advisory feed

CVE-2026-105226: osCommerce2

Severity

2 (LOW)

Vendor

ADOBE

Affected versions

2.3.4.0; 2.3.4.1

Patch status

Unknown

Published

2026-10-05T05:17:03.087

Modified

2026-10-05T05:17:03.087

Why it matters

This matters because the affected product may allow code execution. Prioritize systems that are internet-facing or have privileged access to other infrastructure.

Recommended admin actions

• Review during normal vulnerability triage unless the affected system is internet-facing or business-critical.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

A security flaw has been discovered in osCommerce osCommerce2 up to 2.3.4.1. This vulnerability affects the function include of the file admin/newsletters.php of the component Newsletter Management. Performing a manipulation of the argument module results in code injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

View the official NVD record for CVE-2026-105226

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.