GCVE-110-CERTCC-2012-459446

Advisory PublishedCVSS 5.0/10

Vulnetix · Advisory published September 17, 2012

osCommerce 2.3.1 and possibly other versions with the PayPal website payments standard module is susceptible to a client-side attack that results in an attacker purchasing items without having to pay for them.

Download JSON Open in Console

Risk Scores

CVSS 2.0

5.0/10

Medium · AV:N/AC:L/Au:N/C:N/I:P/A:N

certcc-cam

impact0population0exploitation0widely_known0score_current0ease_of_exploitation0

certcc-vrda

d1_impact3d1_population3d1_direct_report1

certcc-cvss-temporal-env

temporal_score4remediation_levelUreport_confidenceUCenvironmental_score4target_distributionNDenvironmental_vectorCDP:ND/TD:ND/CR:ND/IR:ND/AR:ND

Aliases

CVE-2012-2991

Transitive aliases

GHSA-2g72-w35q-vw79 GSD-2012-2991

References

osCommerce v2.3.1 with PayPal website payments standard module v1.0 design vulnerability

url

osCommerce v2.3.1 with PayPal website payments standard module v1.0 design vulnerability

url

osCommerce v2.3.1 with PayPal website payments standard module v1.0 design vulnerability

url

osCommerce v2.3.1 with PayPal website payments standard module v1.0 design vulnerability

advisory

Browse GCVE Records

73,040 records in the GCVE database · Updated July 15, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON