CVE-2026-18592 is a SQL injection vulnerability affecting osCommerce 4.14.63493. The issue is located in the EmailController function of the file app/lib/backend/controllers/EmailController.php, specifically in the Email Template Configuration component. An attacker can remotely exploit this vulnerability by manipulating the email_templates_key parameter, leading to SQL injection. The vulnerability has been publicly disclosed, and exploit code is available. The vendor has not provided any response or patch at the time of this report.

Successful exploitation of this vulnerability could allow an attacker with high privileges to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without user interaction. The CVSS 4.0 vector indicates low confidentiality, integrity, and availability impacts, resulting in an overall medium severity rating.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fixes have been published, users should consider implementing application-level mitigations such as input validation and parameterized queries if possible. Monitor vendor channels for any future advisories or patches addressing this issue.