Threats tagged 'ghsa-fc65-w3rc-9v2m'

CVE-2026-18592 is a medium severity SQL injection vulnerability affecting osCommerce version 4.14.63493. The flaw exists in the EmailController function within the Email Template Configuration component, where manipulation of the email_templates_key argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. Public exploit code is available, but no official vendor response or patch has been provided.