EC
Product
Ec-cube
26
CVEs
0
On KEV
8.1
Max CVSS
0
New 30D
Severity mix
Critical 0High 5Medium 14Low 1
Watch
Add Ec-cube to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-30777 | 6.5 | Mar 5 | EC-CUBE provided by EC-CUBE CO.,LTD Affected: 4.1.0 before 4.1.2; 4.2.0 before 4.2.3; 4.3.0 before 4.3.1; 4.1.2; 4.1.2; 4.1.2; +5 more |
| CVE-2021-20842 | 6.5 | Nov 24 | Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete… Affected: 2.11.0 through 2.17.1 |
| CVE-2021-20841 | 6.5 | Nov 24 | Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings… Affected: 2.11.2 through 2.17.1 |
| CVE-2021-20751 | 6.1 | Jun 28 | Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a… Affected: 4.0.0 before 4.0.5; 4.0.5. |
| CVE-2021-20750 | 6.1 | Jun 28 | Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an… Affected: 3.0.0 before 3.0.18; 4.0.0 before 4.0.5; 3.0.18; 3.0.18; 4.0.5 |
| CVE-2021-20717 | 6.1 | May 10 | Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is… Affected: 4.0.0 before 4.0.5 |
| CVE-2020-5679 | 6.1 | Dec 3 | Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks Affected: 3.0.0 through 3.0.18 |
| CVE-2018-16191 | 6.1 | Jan 9 | Open redirect vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3.0.4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0.7, EC-CUBE 3.0.8,… Affected: 3.0.0 through 3.0.16 |
| CVE-2023-22438 | 5.4 | Mar 5 | Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0), EC-CUBE 3 series (EC-CUBE… Affected: 2.11.0 through 2.11.5; 2.12.0 through 2.12.6; 2.13.0 through 2.13.5; 2.17.0 through 2.17.2; 3.0.0 through 3.0.18; 4.0.0 through 4.0.6; +10 more |
| CVE-2023-22838 | 5.4 | Mar 5 | Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote… Affected: 4.0.0 through 4.0.6; 4.1.0 through 4.1.2; 4.0.6; 4.0.6; 4.1.2; 4.2.0 |
| CVE-2023-25077 | 5.4 | Mar 5 | Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote authenticated attacker… Affected: 4.0.0 through 4.0.6; 4.1.0 through 4.1.2; 4.0.6; 4.0.6; 4.1.2; 4.2.0 |
| CVE-2022-38975 | 5.4 | Sep 27 | DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an administrative user… Affected: 4.0.0 through 4.1.2 |
| CVE-2022-25355 | 5.3 | Feb 24 | EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version… Affected: 3.0.0 before 3.0.18; 4.0.0 through 4.1.1; 3.0.18; 3.0.18; 3.0.18; 3.0.18 |
| CVE-2023-40281 | 4.8 | Aug 17 | EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page Affected: 2.11.0 through 2.11.5; 2.12.0 through 2.12.6; 2.13.0 before 2.13.5; 2.17.0 before 2.17.2; 2.13.5; 2.13.5; +2 more |
Showing 14