SQL Injection Vulnerability in osCommerce Email Template Configuration
CVE-2026-18592

5.1MEDIUM

Key Information:

Vendor: osCommerce
Status: Oscommerce
Vendor: CVE Published:; 3 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-18592?

A security vulnerability has been identified in osCommerce version 4.14.63493, specifically within the EmailController function located in app/lib/backend/controllers/EmailController.php. This flaw allows an attacker to exploit the email_templates_key argument, leading to SQL injection. The attack can be executed remotely, posing a significant risk to the integrity of the database. Publicly available exploit methods amplify the urgency to address this issue, as the vendor has not provided any response to the reported vulnerability.

Affected Version(s)

osCommerce 4.14.63493

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-18592 - Proof of Concept