Medium severity · published Sep 22, 2025
CVE-2025-59411
CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
CubeCart is an ecommerce software solution. Prior to version 6.5.11, the contact form’s Enquiry field accepts raw HTML and that HTML is included verbatim in the email sent to the store admin. By submitting HTML in the Enquiry, the admin receives an email containing that HTML. This indicates user input is not being escaped or sanitized before being output in email (and possibly when re-rendering the form), leading to Cross-Site Scripting / HTML injection risk in email clients or admin UI. This issue has been patched in version 6.5.11.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
V6
v6 · cubecart
< 6.5.11 · source: vendor
CU
Cubecart · Cubecart
before 6.5.11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59411
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59411
Patch
https://github.com/cubecart/v6/commit/299065bd4a8836782ce92f70988c730f130756db
Patch
https://github.com/cubecart/v6/commit/48336c54532705873a8c4106208c2d596f128047
Exploit
https://github.com/cubecart/v6/security/advisories/GHSA-5hg3-m3q3-v2p4
More from v6
9.1
CVE-2026-45714
CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
9.1
CVE-2026-45053
CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API
9.1
CVE-2026-44377
CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
8.1
CVE-2026-45055
CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header
7.2
CVE-2026-54647
CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php