CVE-2012-1665

Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow (1) remote...

7.5 HighPublic exploit

CVE-2012-1665 is a high vulnerability (CVSS 7.5) in Oscmax, published May 20, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.52%, the 74th percentile. No source names a fixed version.

Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow (1) remote attackers to execute arbitrary SQL commands via the username parameter in a process action to admin/login.php or (2) remote administrators to execute arbitrary SQL commands via the status parameter to admin/stats_monthly_sales.php or (3) country parameter in a process action to admin/create_account_process.php.

Exploit likelihood

1.52%Down 0.3 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2012-1665
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-89
Updated: 2026-11-02

CVE List No score

Record: CVE-2012-1665
Updated: 2026-11-02

EUVDEUVD-2012-1675 No score

Record: EUVD-2012-1675
Updated: 2026-11-03

GitHub AdvisoriesGHSA-c67h-89mw-v4vj No score

Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow (1) remote...

Record: GHSA-c67h-89mw-v4vj
Weakness: CWE-89
Updated: 2026-11-02

Affected products

oscmax

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	osCMax 2.5 - '/admin/login.php?Username' SQL Injection	2012-04-04
Exploit-DB	osCMax 2.5 - '/admin/stats_monthly_sales.php?status' SQL Injection	2012-04-04

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, NVD

Exploit likelihood

What each source reports

Affected products

Public exploits

History

References