TI-2025-36965 Aliases CVE-2025-59412

CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacement

MEDIUM 58CWE-79Published 2025-09-22 · Updated 2025-09-22

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

CubeCart is an ecommerce software solution. Prior to version 6.5.11, a vulnerability exists in the product reviews feature where user-supplied input is not properly sanitized before being displayed. An attacker can submit HTML tags inside the review description field. Once the administrator approves the review, the injected HTML is rendered on the product page for all visitors. This could be used to redirect users to malicious websites or to display unwanted content. This issue has been patched in version 6.5.11.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00286 21st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed v6 (cubecart): 6.5.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
cubecart	v6	before 6.5.11	6.5.11	Patch available	CNA

v6 Vendorcubecart Affected before 6.5.11 Fixed in 6.5.11 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cubecart:cubecart::::::::	before 6.5.11	Vulnerable	cubecart

cpe:2.3:a:cubecart:cubecart:*:*:*:*:*:*:*:* Versions before 6.5.11 Vulnerable ·cubecart

Remediation

Fix · CNA v6 (cubecart) Fixed in 6.5.11

Timeline

2026-10-02 Threatist record created from CVE-2025-59412

References

Exploit 1

https://github.com/cubecart/v6/security/advisories/GHSA-qfrx-vvvp-h5m2

Patch 2

TI-2024-23117 Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to… CVSS 3.1CRITICAL 9.8
TI-2024-22066 File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to… CVSS 3.1HIGH 8.0
TI-2025-36966 CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter CVSS 3.1MEDIUM 6.5
TI-2025-36897 CubeCart Session Not Invalidated After Password Change CVSS 3.1HIGH 7.1
TI-2025-36964 CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry CVSS 3.1MEDIUM 5.4
TI-2013-01273 The Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through… CVSS 3.1CRITICAL 9.8

See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences