Reflected Cross-Site Scripting Vulnerability in osCommerce by osCommerce

CVE-2025-40674

What is CVE-2025-40674?

A reflected Cross-Site Scripting vulnerability has been identified in osCommerce v4, which could allow attackers to inject malicious JavaScript into a victim's browser. By manipulating the URL with specific parameters, an attacker can create a link that, when clicked, executes harmful scripts on the victim's machine. This could enable the theft of sensitive information, such as session tokens, and facilitate unauthorized actions on behalf of the user, potentially leading to serious security breaches.

References