CVE-2008-4170: Oscommerce

Medium severity, CVSS 5.0. EPSS: 1.6% chance of exploitation in the next 30 days.

create_account.php in osCommerce 2.2 RC 2a allows remote attackers to obtain sensitive information via an invalid dob parameter, which reveals the installation path in an error message.

Affected products

• Oscommerce Oscommerce: version 2.2 only

Published 2008-09-22. Last modified 2026-06-16.