Login Request a demo
V6
Product
v6
by cubecart · last CVE Sep 17, 2026
20
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Vulnerabilities20In the news0Timeline
Severity mix
Critical 3High 6Medium 11Low 0
Severity
All severities20Critical3High6Medium11Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add v6 to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-54648
6.5
1%
Sep 17
CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion
Affected: < 6.7.5
CVE-2025-59413
6.5
0%
Sep 22
CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter
Affected: < 6.5.11
CVE-2026-54644
6.1
1%
Sep 17
CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System
Affected: < 6.7.5
CVE-2026-44376
6.1
1%
May 13
CubeCart: Reflected XSS in Store Search Bar
Affected: < 6.7.0
CVE-2026-54643
5.4
0%
Sep 17
CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php
Affected: < 6.7.5
CVE-2025-59412
5.4
0%
Sep 22
CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacement
Affected: < 6.5.11
CVE-2025-59411
5.4
0%
Sep 22
CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry
Affected: < 6.5.11
CVE-2026-54642
5.3
0%
Sep 17
CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php
Affected: < 6.7.5
CVE-2026-45054
4.9
0%
May 13
CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listing
Affected: < 6.7.0
CVE-2026-54645
4.8
1%
Sep 17
CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass
Affected: < 6.7.5
CVE-2026-39428
4.8
0%
May 13
CubeCart: Stored Cross-Site Scripting (XSS)
Affected: < 6.6.0
Showing 11