Vulnerabilities

TI-2026-39472 CVE-2026-54645

CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass

MEDIUM 55

CubeCart is an ecommerce software solution.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.01081 Published 2026-09-17 Fixed in 6.7.5 CWE-79

TI-2026-39470 CVE-2026-54643

CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php

MEDIUM 58

CubeCart is an ecommerce software solution.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.0038 Published 2026-09-17 Fixed in 6.7.5 CWE-862

TI-2026-39469 CVE-2026-54642

CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php

LOW 24

CubeCart is an ecommerce software solution.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00325 Published 2026-09-17 Fixed in 6.7.5 CWE-352

TI-2026-39471 CVE-2026-54644

CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System

MEDIUM 60

CubeCart is an ecommerce software solution.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00899 Published 2026-09-17 Fixed in 6.7.5 CWE-79

TI-2026-39474 CVE-2026-54647

CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php

LOW 37

CubeCart is an ecommerce software solution.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01447 Published 2026-09-17 Fixed in 6.7.5 CWE-89

TI-2026-39473 CVE-2026-54646

CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php

LOW 37

CubeCart is an ecommerce software solution.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01447 Published 2026-09-17 Fixed in 6.7.5 CWE-89

TI-2026-39475 CVE-2026-54648

CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion

MEDIUM 62

CubeCart is an ecommerce software solution.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00594 Published 2026-09-17 Fixed in 6.7.5 CWE-862

TI-2026-33448 CVE-2026-45708

CubeCart: Authenticated RCE via Invoice Template → Order Print

HIGH 67

CubeCart is an ecommerce software solution.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00306 Published 2026-05-13 Fixed in 6.7.3 CWE-94

TI-2026-32904 CVE-2026-45055

CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header

HIGH 70

CubeCart is an ecommerce software solution.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00147 Published 2026-05-13 Fixed in 6.7.2 CWE-20

TI-2026-33453 CVE-2026-45714

CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE

HIGH 74

CubeCart is an ecommerce software solution.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00415 Published 2026-05-13 Fixed in 6.7.0 CWE-1336

TI-2026-32903 CVE-2026-45054

CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listing

MEDIUM 56

CubeCart is an ecommerce software solution.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00239 Published 2026-05-13 Fixed in 6.7.0 CWE-89

TI-2026-32902 CVE-2026-45053

CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API

HIGH 74

CubeCart is an ecommerce software solution.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00585 Published 2026-05-13 Fixed in 6.7.0 CWE-434

TI-2026-32333 CVE-2026-44376

CubeCart: Reflected XSS in Store Search Bar

LOW 36

CubeCart is an ecommerce software solution.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00697 Published 2026-05-13 Fixed in 6.7.0 CWE-79

TI-2026-28409 CVE-2026-39428

CubeCart: Stored Cross-Site Scripting (XSS)

MEDIUM 55

CubeCart is an ecommerce software solution.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00173 Published 2026-05-13 Fixed in 6.6.0 CWE-79

TI-2026-28345 CVE-2026-39358

CubeCart: Time-based Blind SQL Injection

HIGH 67

CubeCart is an ecommerce software solution.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00307 Published 2026-05-13 Fixed in 6.6.0 CWE-89

TI-2026-32334 CVE-2026-44377

CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE

HIGH 74

CubeCart is an ecommerce software solution.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00735 Published 2026-05-13 Fixed in 6.7.0 CWE-1336

TI-2026-27622 CVE-2026-35496 · GHSA-4p7p-gf39-gmhp

Path traversal in CubeCart

LOW 23

A path traversal vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to access higher-level directories that should not be accessible.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.0032 Published 2026-04-17 Fixed in 6.6.0 CWE-22

TI-2026-26344 CVE-2026-34018 · GHSA-hfjg-jhg9-mrvf

SQL injection in CubeCart

LOW 22

An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the product.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00179 Published 2026-04-17 Fixed in 6.6.0 CWE-89

TI-2026-17492 CVE-2026-21719 · GHSA-mj52-hprj-j8xh

OS command injection in CubeCart

MEDIUM 42

An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to execute an arbitrary OS command.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01203 Published 2026-04-17 Fixed in 6.6.0 CWE-78

TI-2025-36966 CVE-2025-59413

CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter

HIGH 68

CubeCart is an ecommerce software solution.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00397 Published 2025-09-22 Fixed in 6.5.11 CWE-862

TI-2025-36965 CVE-2025-59412

CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacement

MEDIUM 58

CubeCart is an ecommerce software solution.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00286 Published 2025-09-22 Fixed in 6.5.11 CWE-79

TI-2025-36964 CVE-2025-59411

CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry

MEDIUM 58

CubeCart is an ecommerce software solution.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00296 Published 2025-09-22 Fixed in 6.5.11 CWE-79

TI-2025-36897 CVE-2025-59335

CubeCart Session Not Invalidated After Password Change

HIGH 66

CubeCart is an ecommerce software solution.

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00207 Published 2025-09-22 Fixed in 6.5.11 CWE-613

TI-2024-23117 CVE-2024-34832 · GHSA-jfv8-vg3m-73pc

Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to…

HIGH 82

Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to the _g and node parameters.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05012 Published 2024-06-06 No fix listed CWE-22

TI-2024-22066 CVE-2024-33438 · GHSA-x58x-j223-hqhm

File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to…

HIGH 70

File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to execute arbitrary code via a crafted .phar file.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.01127 Published 2024-04-29 No fix listed CWE-434

Vulnerabilities

Filters