Priority HIGH 82
Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to the _g and node parameters.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.05012 · Published 2024-06-06 · No fix listed CWE-22
Priority HIGH 74
CubeCart is an ecommerce software solution.
CVSS 3.1CRITICAL 9.1· Network · High privileges · No interaction · EPSS 0.00415 · Published 2026-05-13 · Fixed in 6.7.0 CWE-1336
Priority HIGH 74
CubeCart is an ecommerce software solution.
CVSS 3.1CRITICAL 9.1· Network · High privileges · No interaction · EPSS 0.00585 · Published 2026-05-13 · Fixed in 6.7.0 CWE-434
Priority HIGH 74
CubeCart is an ecommerce software solution.
CVSS 3.1CRITICAL 9.1· Network · High privileges · No interaction · EPSS 0.00735 · Published 2026-05-13 · Fixed in 6.7.0 CWE-1336
Priority HIGH 70
CubeCart is an ecommerce software solution.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.00147 · Published 2026-05-13 · Fixed in 6.7.2 CWE-20
Priority HIGH 70
File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to execute arbitrary code via a crafted .phar file.
CVSS 3.1HIGH 8.0· Network · Low privileges · User interaction · EPSS 0.01127 · Published 2024-04-29 · No fix listed CWE-434
Priority HIGH 68
CubeCart is an ecommerce software solution.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00397 · Published 2025-09-22 · Fixed in 6.5.11 CWE-862
Priority HIGH 67
CubeCart is an ecommerce software solution.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00306 · Published 2026-05-13 · Fixed in 6.7.3 CWE-94
Priority HIGH 67
CubeCart is an ecommerce software solution.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00307 · Published 2026-05-13 · Fixed in 6.6.0 CWE-89
Priority HIGH 66
CubeCart is an ecommerce software solution.
CVSS 3.1HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.00207 · Published 2025-09-22 · Fixed in 6.5.11 CWE-613
Priority MEDIUM 62
CubeCart is an ecommerce software solution.
CVSS 3.1MEDIUM 6.5· Network · High privileges · No interaction · EPSS 0.00594 · Published 2026-09-17 · Fixed in 6.7.5 CWE-862
Priority MEDIUM 60
CubeCart is an ecommerce software solution.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00899 · Published 2026-09-17 · Fixed in 6.7.5 CWE-79
Priority MEDIUM 58
CubeCart is an ecommerce software solution.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.0038 · Published 2026-09-17 · Fixed in 6.7.5 CWE-862
Priority MEDIUM 58
CubeCart is an ecommerce software solution.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00286 · Published 2025-09-22 · Fixed in 6.5.11 CWE-79
Priority MEDIUM 58
CubeCart is an ecommerce software solution.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00296 · Published 2025-09-22 · Fixed in 6.5.11 CWE-79
Priority MEDIUM 56
CubeCart is an ecommerce software solution.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00239 · Published 2026-05-13 · Fixed in 6.7.0 CWE-89
Priority MEDIUM 55
CubeCart is an ecommerce software solution.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.01081 · Published 2026-09-17 · Fixed in 6.7.5 CWE-79
Priority MEDIUM 55
CubeCart is an ecommerce software solution.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00173 · Published 2026-05-13 · Fixed in 6.6.0 CWE-79
Priority MEDIUM 52
The Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows remote attackers to unserialize arbitrary PHP objects via a crafted shipping parameter, as demonstrated by modifying the a…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.07086 · Published 2013-02-08 · No fix listed CWE-502
Priority MEDIUM 44
CubeCart before 6.1.13 has SQL Injection via the validate[] parameter of the "I forgot my Password!" feature.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01177 · Published 2019-01-15 · No fix listed CWE-89
Priority MEDIUM 44
classes/session/cc_admin_session.php in CubeCart 4.3.4 does not properly restrict administrative access permissions, which allows remote attackers to bypass restrictions and gain administrative access via a HTTP request…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.08665 · Published 2009-11-06 · No fix listed CWE-264
Priority MEDIUM 42
An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to execute an arbitrary OS command.
CVSS 4.0HIGH 8.6· Network · High privileges · No interaction · EPSS 0.01203 · Published 2026-04-17 · Fixed in 6.6.0 CWE-78
Priority LOW 39
Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID parameter.
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.05825 · Published 2014-04-21 · No fix listed CWE-287
Priority LOW 37
CubeCart is an ecommerce software solution.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01447 · Published 2026-09-17 · Fixed in 6.7.5 CWE-89
Priority LOW 37
CubeCart is an ecommerce software solution.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01447 · Published 2026-09-17 · Fixed in 6.7.5 CWE-89
Load more
THREATIST.IORead the docs