Advisories · Technology
cubecart v6.
Every CVE that names cubecart v6 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.8 Medium
CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass
- cubecart v6
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php
- cubecart v6
- Broken access control
- CVSS 5.3 Medium
CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php
- cubecart v6
- Cross-site request forgery (CSRF)
- CVSS 6.1 Medium
CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System
- cubecart v6
- Cross-site scripting (XSS)
- CVSS 7.2 High
CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php
- cubecart v6
- SQL injection
- CVSS 7.2 High
CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php
- cubecart v6
- SQL injection
- CVSS 6.5 Medium
CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion
- cubecart v6
- Broken access control
- CVSS 7.2 High
CubeCart: Authenticated RCE via Invoice Template → Order Print
- cubecart v6
- Code injection
- CVSS 8.1 High
CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header
- cubecart v6
- Open redirect
- CWE-20
- CVSS 9.1 CriticalCritical · CVSS 9+
CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
- cubecart v6
- Code injection
- CVSS 4.9 Medium
CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listing
- cubecart v6
- SQL injection
- CVSS 9.1 CriticalCritical · CVSS 9+
CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API
- cubecart v6
- Unrestricted file upload
- CVSS 6.1 Medium
CubeCart: Reflected XSS in Store Search Bar
- cubecart v6
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
CubeCart: Stored Cross-Site Scripting (XSS)
- cubecart v6
- Cross-site scripting (XSS)
- CVSS 7.2 High
CubeCart: Time-based Blind SQL Injection
- cubecart v6
- SQL injection
- CVSS 9.1 CriticalCritical · CVSS 9+
CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
- cubecart v6
- Code injection
- CVSS 6.5 Medium
CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter
- cubecart v6
- Broken access control
- CVSS 5.4 Medium
CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacement
- cubecart v6
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry
- cubecart v6
- Cross-site scripting (XSS)
- CVSS 7.1 High
CubeCart Session Not Invalidated After Password Change
- cubecart v6
- Authentication bypass