EC
Product
Ec-cube
26
CVEs
0
On KEV
8.1
Max CVSS
0
New 30D
Severity mix
Critical 0High 5Medium 14Low 1
Watch
Add Ec-cube to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-5590 | 8.1 | Jun 19 | Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server… Affected: 3.0.0 through 3.0.18; 4.0.0 through 4.0.3 |
| CVE-2021-20778 | 7.5 | Jul 1 | Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified… Affected: 4.0.6 |
| CVE-2020-5680 | 7.5 | Dec 3 | Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vector Affected: 3.0.5 through 3.0.18 |
| CVE-2024-41924 | 7.2 | Jul 30 | Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series Affected: 4.0.0 through 4.0.6-p4; 4.1.0 through 4.1.2-p3; 4.2.0 through 4.2.3 |
| CVE-2023-46845 | 7.2 | Nov 7 | EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper… Affected: 3.0.0 through 3.0.18; 4.0.0 through 4.0.6; 4.1.0 through 4.1.2; 4.2.0 before 4.2.3; 3.0.18; 3.0.18; +9 more |
| CVE-2026-30777 | 6.5 | Mar 5 | EC-CUBE provided by EC-CUBE CO.,LTD Affected: 4.1.0 before 4.1.2; 4.2.0 before 4.2.3; 4.3.0 before 4.3.1; 4.1.2; 4.1.2; 4.1.2; +5 more |
| CVE-2021-20842 | 6.5 | Nov 24 | Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete… Affected: 2.11.0 through 2.17.1 |
| CVE-2021-20841 | 6.5 | Nov 24 | Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings… Affected: 2.11.2 through 2.17.1 |
| CVE-2021-20751 | 6.1 | Jun 28 | Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a… Affected: 4.0.0 before 4.0.5; 4.0.5. |
| CVE-2021-20750 | 6.1 | Jun 28 | Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an… Affected: 3.0.0 before 3.0.18; 4.0.0 before 4.0.5; 3.0.18; 3.0.18; 4.0.5 |
| CVE-2021-20717 | 6.1 | May 10 | Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is… Affected: 4.0.0 before 4.0.5 |
| CVE-2020-5679 | 6.1 | Dec 3 | Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks Affected: 3.0.0 through 3.0.18 |
| CVE-2018-16191 | 6.1 | Jan 9 | Open redirect vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3.0.4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0.7, EC-CUBE 3.0.8,… Affected: 3.0.0 through 3.0.16 |
| CVE-2023-22438 | 5.4 | Mar 5 | Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0), EC-CUBE 3 series (EC-CUBE… Affected: 2.11.0 through 2.11.5; 2.12.0 through 2.12.6; 2.13.0 through 2.13.5; 2.17.0 through 2.17.2; 3.0.0 through 3.0.18; 4.0.0 through 4.0.6; +10 more |
| CVE-2023-22838 | 5.4 | Mar 5 | Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote… Affected: 4.0.0 through 4.0.6; 4.1.0 through 4.1.2; 4.0.6; 4.0.6; 4.1.2; 4.2.0 |
| CVE-2023-25077 | 5.4 | Mar 5 | Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote authenticated attacker… Affected: 4.0.0 through 4.0.6; 4.1.0 through 4.1.2; 4.0.6; 4.0.6; 4.1.2; 4.2.0 |
| CVE-2022-38975 | 5.4 | Sep 27 | DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an administrative user… Affected: 4.0.0 through 4.1.2 |
| CVE-2022-25355 | 5.3 | Feb 24 | EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version… Affected: 3.0.0 before 3.0.18; 4.0.0 through 4.1.1; 3.0.18; 3.0.18; 3.0.18; 3.0.18 |
| CVE-2023-40281 | 4.8 | Aug 17 | EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page Affected: 2.11.0 through 2.11.5; 2.12.0 through 2.12.6; 2.13.0 before 2.13.5; 2.17.0 before 2.17.2; 2.13.5; 2.13.5; +2 more |
| CVE-2022-40199 | 2.7 | Sep 27 | Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an… Affected: 3.0.0 before 3.0.18; 4.0.0 through 4.1.2; 3.0.18; 3.0.18; 3.0.18; 3.0.18; +1 more |
| CVE-2008-4991 | – | Nov 6 | SQL injection vulnerability in LOCKON CO.,LTD Affected: through 1.3.5; through 1.4.7; through 1.5.0; through 2.3.0; 1.3.4 |
| CVE-2008-4537 | – | Oct 10 | Cross-site scripting (XSS) vulnerability in EC-CUBE Ver1 1.4.6 and earlier, Ver1 Beta 1.5.0-beta and earlier, Ver2 2.1.2a and earlier, Ver2 Beta(RC) 2.1.1-beta and earlier,… Affected: through 1.3.4; through 2.1.2a; through 2.3.0; 1.0; 1.4.7; 1.5.0 |
| CVE-2008-4536 | – | Oct 10 | Cross-site scripting (XSS) vulnerability in EC-CUBE Ver1 1.4.6 and earlier, Ver1 Beta 1.5.0-beta and earlier, Ver2 2.1.2a and earlier, Ver2 Beta(RC) 2.2.0-beta and earlier,… Affected: through 1.3.4; through 2.1.2a; through 2.3.0; 1.0; 1.4.7; 1.5.0 |
| CVE-2008-4535 | – | Oct 10 | Cross-site scripting (XSS) vulnerability in EC-CUBE Ver2 2.1.2a and earlier, EC-CUBE Ver2 Beta(RC) 2.2.0-beta and earlier, and EC-CUBE Community Edition Nighly-Build r17623 and… Affected: through 2.1.2a; through 2.3.0; 1.0; 1.4.7; 1.5.0 |
| CVE-2008-4534 | – | Oct 10 | SQL injection vulnerability in EC-CUBE Ver2 2.1.2a and earlier, and Ver2 RC 2.3.0-rc1 and earlier, allows remote attackers to execute arbitrary SQL commands via unspecified… Affected: through 2.1.2a; through 2.3.0; 1.0; 1.4.7; 1.5.0 |
| CVE-2006-6108 | – | Nov 26 | Cross-site scripting (XSS) vulnerability in EC-CUBE before 1.0.1a-beta allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors Affected: 1.0 |
Showing 26