EIP-2026-110385

This writeup describes an authentication bypass and file disclosure vulnerability in OsCommerce Online Merchant v2.2. The bypass allows unauthorized access to admin pages by appending '/login.php' to the URL, while the file disclosure enables downloading sensitive files via a crafted request.