osCommerce EUVD-2026-92250

Exploitation requires administrator-level authenticated access to the osCommerce2 backend, specifically reachability of the Newsletter Management feature at admin/newsletters.php, where the 'module' argument is passed to include logic. The limiting factor is the PR:H requirement: the attacker must already possess valid administrator credentials or an active admin session, so this is not exploitable by anonymous or low-privileged remote users. No special non-default configuration is indicated, but the administrative panel must be network-reachable (AV:N) and the Newsletter module accessible.

This is a low-priority issue despite being a 'code injection' flaw. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L) scores only 2.0, driven by PR:H - exploitation requires high privileges, consistent with the vulnerable code residing in admin/newsletters.php (the administrative Newsletter Management backend). An attacker must already hold administrator access, which sharply limits real-world risk: an admin can typically perform damaging actions directly, so the marginal value of this injection is modest, reflected in the uniformly Low impact metrics (VC:L/VI:L/VA:L). A public exploit exists (E:P in the vector, and the description states 'the exploit has been released to the public'), raising the practical likelihood of opportunistic use, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. The vulnerability was reported to the project via an issue report but the project has not responded, meaning no official patch is confirmed. Signals are internally consistent (network-reachable admin feature, privilege-gated, low impact); the main caveat is that 'code injection' intuitively sounds severe but the CVSS author deliberately scored impacts as Low and required high privileges - do not overweight the CWE label.

An authenticated administrator (or an attacker who has already compromised admin credentials) sends a crafted request to admin/newsletters.php manipulating the 'module' argument, causing the include logic to process attacker-controlled input and inject/execute code within the application context. A public exploit has been released, lowering the skill needed to reproduce it, though the requirement for administrator-level access substantially constrains who can actually trigger it.