An XSS security flaw has been found in osCMax, specifically the printable catalog module. The flaw is in all 2.0 versions, including RC3, RC3.0.1, RC3.0.2, and RC4 SVN.

A security hole was found in osCMax 2.0 RC 3.0.1 that allows a remote attacker to upload files to your site via a browser.

We are nearing a public release of osCMax2.0 RC4. It has been available via the SVN repository for some time now, but not packaged and released for general public usage.

There have been a lot of updates this week that really push the new version closer to being declared stable.

There are always a few posts every month in the forums asking the the same basic questions about the osCMax template system.

Weekly Update 5-4-08

This week, I have put a lot of effort into some of the admin panel features that have not been updated in a very long time. The following have been added or upgraded:

Code Updates

Today the Order Editor and Manual Order Maker in the osCMax admin panel were fully updated in the RC4 development branch. This code can be obtained from the SVN repository .

Weekly Update

Continuing the trend of more commits to the SVN repository for osCMax RC4, I have finished updating the installer for osCMax.

I am just about finished the code changes to update the osCMax installer to no longer require register globals to be on.