CVE-2012-5794: The MoneyBookers module in osCommerce does not verify that the server hostname matches a domain name in the...

Security readout for executives and security teams

This CVE concerns the osCommerce MoneyBookers module failing to check whether an SSL certificate belongs to the server it contacted. A network-positioned attacker could impersonate an SSL server using a valid certificate for another name. Sources do not provide CVSS, fixed versions, or evidence of active exploitation. Exposure is most likely limited to legacy osCommerce deployments using the MoneyBookers payment module. The supplied CVE data does not identify exact affected versions, package names, or CPEs, so asset confirmation is required. Treat this as a legacy payment-integration risk. Prioritize confirmation if osCommerce or MoneyBookers was ever used in revenue systems, but do not assume current active exploitation from the supplied evidence. Mitigation focus: Inventory osCommerce sites for the MoneyBookers module.; Check vendor or maintainer guidance for patched or replacement payment code.; Disable the module if hostname verification cannot be confirmed..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.