Login Request a demo
V6
Product
v6
by cubecart · last CVE Sep 17, 2026
20
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Vulnerabilities20In the news0Timeline
Severity mix
Critical 3High 6Medium 11Low 0
Severity
All severities20Critical3High6Medium11Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add v6 to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-45055
8.1
0%
May 13
CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header
Affected: < 6.7.2
CVE-2026-54647
7.2
1%
Sep 17
CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php
Affected: < 6.7.5
CVE-2026-54646
7.2
1%
Sep 17
CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php
Affected: < 6.7.5
CVE-2026-45708
7.2
0%
May 13
CubeCart: Authenticated RCE via Invoice Template → Order Print
Affected: < 6.7.3
CVE-2026-39358
7.2
0%
May 13
CubeCart: Time-based Blind SQL Injection
Affected: < 6.6.0
CVE-2025-59335
7.1
0%
Sep 22
CubeCart Session Not Invalidated After Password Change
Affected: < 6.5.11
Showing 6