CVE-2020-23360

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-01-27 · updated 2026-06-17
Weakness: CWE-697

Description

oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/admin/administrators.php and /catalog/password_reset.php

Affected products

Os Commerce: 2.3.4.1

References

https://github.com/osCommerce/oscommerce2/issues/658
https://github.com/osCommerce/oscommerce2/issues/658

Get alerted when CVE-2020-23360 or the next vulnerability affects your stack