CVE-2012-2991

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-09-19 · updated 2026-06-16

Description

The PayPal (aka MODULE_PAYMENT_PAYPAL_STANDARD) module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self.

Affected products

osCommerce Online Merchant: through 2.3.3; 2.3.0, 2.3.1, 2.3.2
PayPal Website Payments Standard Module: through 1.0

References

http://secunia.com/advisories/50640
http://www.kb.cert.org/vuls/id/459446
http://secunia.com/advisories/50640
http://www.kb.cert.org/vuls/id/459446

Get alerted when CVE-2012-2991 or the next vulnerability affects your stack