Medium severity · published Sep 22, 2025
CVE-2025-59412
CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacement
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
CubeCart is an ecommerce software solution. Prior to version 6.5.11, a vulnerability exists in the product reviews feature where user-supplied input is not properly sanitized before being displayed. An attacker can submit HTML tags inside the review description field. Once the administrator approves the review, the injected HTML is rendered on the product page for all visitors. This could be used to redirect users to malicious websites or to display unwanted content. This issue has been patched in version 6.5.11.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
V6
v6 · cubecart
< 6.5.11 · source: vendor
CU
Cubecart · Cubecart
before 6.5.11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59412
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59412
Patch
https://github.com/cubecart/v6/commit/1a0c0d8f6c9c141575eb5be07d04e7d49820005b
Patch
https://github.com/cubecart/v6/commit/7d4bf593304332fa1258d4f0b10dd7c9f6283a86
Exploit
https://github.com/cubecart/v6/security/advisories/GHSA-qfrx-vvvp-h5m2
More from v6
9.1
CVE-2026-45714
CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
9.1
CVE-2026-45053
CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API
9.1
CVE-2026-44377
CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
8.1
CVE-2026-45055
CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header
7.2
CVE-2026-54647
CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php