Login Request a demo
CU
Vendor
Cubecart
2 products with CVEs on record
49
CVEs
0
On KEV
0
New 30D
Products
CU
Cubecart
Cubecart
9.8
29 CVEs0 on KEV0 new
V6
v6
cubecart
9.1
20 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-54645
V6
v6
cubecart
4.8
1%
Sep 17CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass
CVE-2026-54643
V6
v6
cubecart
5.4
0%
Sep 17CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php
CVE-2026-54642
V6
v6
cubecart
5.3
0%
Sep 17CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php
CVE-2026-54644
V6
v6
cubecart
6.1
1%
Sep 17CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System
CVE-2026-54647
V6
v6
cubecart
7.2
1%
Sep 17CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php
CVE-2026-54646
V6
v6
cubecart
7.2
1%
Sep 17CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php
CVE-2026-54648
V6
v6
cubecart
6.5
1%
Sep 17CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion
CVE-2026-45708
V6
v6
cubecart
7.2
0%
May 13CubeCart: Authenticated RCE via Invoice Template → Order Print
CVE-2026-45055
V6
v6
cubecart
8.1
0%
May 13CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header
CVE-2026-45714
V6
v6
cubecart
9.1
0%
May 13CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
CVE-2026-45054
V6
v6
cubecart
4.9
0%
May 13CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listing
CVE-2026-45053
V6
v6
cubecart
9.1
1%
May 13CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API
CVE-2026-44376
V6
v6
cubecart
6.1
1%
May 13CubeCart: Reflected XSS in Store Search Bar
CVE-2026-39428
V6
v6
cubecart
4.8
0%
May 13CubeCart: Stored Cross-Site Scripting (XSS)
CVE-2026-39358
V6
v6
cubecart
7.2
0%
May 13CubeCart: Time-based Blind SQL Injection
CVE-2026-44377
V6
v6
cubecart
9.1
1%
May 13CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
CVE-2026-35496
CU
Cubecart
Cubecart
2.7
0%
Apr 17A path traversal vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to access higher-level directories that should not be…
CVE-2026-34018
CU
Cubecart
Cubecart
9.8
0%
Apr 17An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the product
CVE-2026-21719
CU
Cubecart
Cubecart
7.2
1%
Apr 17An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to execute an arbitrary OS command
CVE-2025-59413
V6
v6
cubecart
6.5
0%
Sep 22CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter
CVE-2025-59412
V6
v6
cubecart
5.4
0%
Sep 22CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacement
CVE-2025-59411
V6
v6
cubecart
5.4
0%
Sep 22CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry
CVE-2025-59335
V6
v6
cubecart
7.1
0%
Sep 22CubeCart Session Not Invalidated After Password Change
CVE-2024-34832
CU
Cubecart
Cubecart
9.8
5%
Jun 6Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to the _g and node parameters
CVE-2024-33438
CU
Cubecart
Cubecart
8.0
1%
Apr 29File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to execute arbitrary code via a crafted .phar file
CVE-2023-47675
CU
Cubecart
Cubecart
7.2
1%
Nov 17CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command
CVE-2023-47283
CU
Cubecart
Cubecart
4.9
1%
Nov 17Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to obtain files in the system
CVE-2023-42428
CU
Cubecart
Cubecart
6.5
1%
Nov 17Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to delete directories and files in the system
CVE-2023-38130
CU
Cubecart
Cubecart
8.1
0%
Nov 17Cross-site request forgery (CSRF) vulnerability in CubeCart prior to 6.5.3 allows a remote unauthenticated attacker to delete data in the system
CVE-2021-33394
CU
Cubecart
Cubecart
5.4
1%
May 27Cubecart 6.4.2 allows Session Fixation
CVE-2018-20716
CU
Cubecart
Cubecart
9.8
1%
Jan 15CubeCart before 6.1.13 has SQL Injection via the validate[] parameter of the "I forgot my Password!" feature
CVE-2018-20703
CU
Cubecart
Cubecart
5.4
1%
Jan 13CubeCart 6.2.2 has Reflected XSS via a /{ADMIN-FILE}/ query string
CVE-2017-2098
CU
Cubecart
Cubecart
6.5
2%
Apr 28Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors
CVE-2017-2117
CU
Cubecart
Cubecart
4.9
2%
Apr 28Directory traversal vulnerability in CubeCart versions prior to 6.1.5 allows attacker with administrator rights to read arbitrary files via unspecified vectors
CVE-2017-2090
CU
Cubecart
Cubecart
6.5
2%
Apr 28Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors
CVE-2015-6928
CU
Cubecart
Cubecart
–
2%
Sep 28classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was made, which allows remote attackers to…
CVE-2014-2341
CU
Cubecart
Cubecart
–
6%
Apr 21Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID parameter
CVE-2013-1465
CU
Cubecart
Cubecart
9.8
7%
Feb 8The Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows remote attackers to unserialize arbitrary PHP objects via a crafted shipping…
CVE-2012-0865
CU
Cubecart
Cubecart
–
3%
Feb 21Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the…
CVE-2010-4903
CU
Cubecart
Cubecart
–
1%
Oct 8SQL injection vulnerability in index.php in CubeCart 4.3.3 allows remote attackers to execute arbitrary SQL commands via the searchStr parameter
CVE-2011-3724
CU
Cubecart
Cubecart
–
1%
Sep 23CubeCart 4.4.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as…
CVE-2010-1931
CU
Cubecart
Cubecart
–
1%
Jun 10SQL injection vulnerability in includes/content/cart.inc.php in CubeCart PHP Shopping cart 4.3.4 through 4.3.9 allows remote attackers to execute arbitrary SQL commands via the…
CVE-2009-4060
CU
Cubecart
Cubecart
–
2%
Nov 24SQL injection vulnerability in includes/content/viewProd.inc.php in CubeCart before 4.3.7 remote attackers to execute arbitrary SQL commands via the productId parameter
CVE-2009-3904
CU
Cubecart
Cubecart
–
9%
Nov 6classes/session/cc_admin_session.php in CubeCart 4.3.4 does not properly restrict administrative access permissions, which allows remote attackers to bypass restrictions and gain…
CVE-2008-1550
CU
Cubecart
Cubecart
–
1%
Mar 31Multiple cross-site scripting (XSS) vulnerabilities in index.php in CubeCart 4.2.1 allow remote attackers to inject arbitrary web script or HTML via (1) the _a parameter in a…