EC
Vendor
Ec-cube
40
CVEs
0
On KEV
0
New 30D
Products
EC8.1
Ec-cube
Ec-cube
26 CVEs0 on KEV0 new
BF6.1
Business Form Output
Ec-cube
2 CVEs0 on KEV0 new
EP7.2
Ec-cube Payment Module
Ec-cube
2 CVEs0 on KEV0 new
AP6.1
Amazon Pay
Ec-cube
1 CVEs0 on KEV0 new
DS6.1
Delivery Slip Number
Ec-cube
1 CVEs0 on KEV0 new
DS6.1
Delivery Slip Number Csv Bulk Registration
Ec-cube
1 CVEs0 on KEV0 new
DS6.1
Delivery Slip Number Mail
Ec-cube
1 CVEs0 on KEV0 new
DC9.8
Discount Coupon
Ec-cube
1 CVEs0 on KEV0 new
EN4.3
E-mail Newsletter Management
Ec-cube
1 CVEs0 on KEV0 new
E24.8
Ec-cube 2
Ec-cube
1 CVEs0 on KEV0 new
EV–
Ec-cube Ver2
Ec-cube
1 CVEs0 on KEV0 new
EN6.1
Email Newsletters Management
Ec-cube
1 CVEs0 on KEV0 new
PI9.8
Product Image Bulk Upload
Ec-cube
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-30777 | EC Ec-cube Ec-cube | 6.5 | Mar 5 | EC-CUBE provided by EC-CUBE CO.,LTD |
| CVE-2024-41924 | EC Ec-cube Ec-cube | 7.2 | Jul 30 | Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series |
| CVE-2023-46845 | EC Ec-cube Ec-cube | 7.2 | Nov 7 | EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper… |
| CVE-2023-40281 | EC Ec-cube Ec-cube | 4.8 | Aug 17 | EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page |
| CVE-2023-22438 | EC Ec-cube Ec-cube | 5.4 | Mar 5 | Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0), EC-CUBE 3 series (EC-CUBE… |
| CVE-2023-25077 | EC Ec-cube Ec-cube | 5.4 | Mar 5 | Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote authenticated attacker… |
| CVE-2023-22838 | EC Ec-cube Ec-cube | 5.4 | Mar 5 | Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote… |
| CVE-2022-40199 | EC Ec-cube Ec-cube | 2.7 | Sep 27 | Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an… |
| CVE-2022-38975 | EC Ec-cube Ec-cube | 5.4 | Sep 27 | DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an administrative user… |
| CVE-2022-37346 | PI Product Image Bulk Upload Ec-cube | 9.8 | Sep 27 | EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files |
| CVE-2022-25355 | EC Ec-cube Ec-cube | 5.3 | Feb 24 | EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version… |
| CVE-2022-21179 | EN E-mail Newsletter Management Ec-cube | 4.3 | Feb 24 | Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0.4 (for EC-CUBE 3… |
| CVE-2021-20842 | EC Ec-cube Ec-cube | 6.5 | Nov 24 | Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete… |
| CVE-2021-20841 | EC Ec-cube Ec-cube | 6.5 | Nov 24 | Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings… |
| CVE-2021-20778 | EC Ec-cube Ec-cube | 7.5 | Jul 1 | Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified… |
| CVE-2021-20751 | EC Ec-cube Ec-cube | 6.1 | Jun 28 | Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a… |
| CVE-2021-20750 | EC Ec-cube Ec-cube | 6.1 | Jun 28 | Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an… |
| CVE-2021-20744 | BF Business Form Output Ec-cube | 6.1 | Jun 22 | Cross-site scripting vulnerability in EC-CUBE Category contents plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.1 allows a remote attacker to inject an arbitrary… |
| CVE-2021-20743 | EN Email Newsletters Management Ec-cube | 6.1 | Jun 22 | Cross-site scripting vulnerability in EC-CUBE Email newsletters management plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.4 allows a remote attacker to inject an… |
| CVE-2021-20742 | BF Business Form Output Ec-cube | 6.1 | Jun 22 | Cross-site scripting vulnerability in EC-CUBE Business form output plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.1 allows a remote attacker to inject an arbitrary… |
| CVE-2021-20735 | DS Delivery Slip Number Ec-cube | 6.1 | Jun 22 | Cross-site scripting vulnerability in ETUNA EC-CUBE plugins (Delivery slip number plugin (3.0 series) 1.0.10 and earlier, Delivery slip number csv bulk registration plugin (3.0… |
| CVE-2021-20717 | EC Ec-cube Ec-cube | 6.1 | May 10 | Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is… |
| CVE-2020-5680 | EC Ec-cube Ec-cube | 7.5 | Dec 3 | Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vector |
| CVE-2020-5679 | EC Ec-cube Ec-cube | 6.1 | Dec 3 | Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks |
| CVE-2020-5590 | EC Ec-cube Ec-cube | 8.1 | Jun 19 | Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server… |
| CVE-2019-6003 | AP Amazon Pay Ec-cube | 6.1 | Sep 12 | Cross-site scripting vulnerability in EC-CUBE plugin 'Amazon Pay Plugin 2.12,2.13' version 2.4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via… |
| CVE-2018-16191 | EC Ec-cube Ec-cube | 6.1 | Jan 9 | Open redirect vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3.0.4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0.7, EC-CUBE 3.0.8,… |
| CVE-2018-0658 | EP Ec-cube Payment Module Ec-cube | 7.2 | Sep 7 | Input validation issue in EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG… |
| CVE-2018-0657 | EP Ec-cube Payment Module Ec-cube | 4.8 | Sep 7 | Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and… |
| CVE-2016-4837 | DC Discount Coupon Ec-cube | 9.8 | Aug 1 | SQL injection vulnerability in the Seed Coupon plugin before 1.6 for EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors |
| CVE-2009-4236 | EV Ec-cube Ver2 Ec-cube | – | Dec 8 | The process function in data/class/pages/admin/customer/LC_Page_Admin_Customer_SearchCustomer.php in EC-CUBE Ver2 2.4.0 RC1 through 2.4.1, and Community Edition r18068 through… |
| CVE-2008-4991 | EC Ec-cube Ec-cube | – | Nov 6 | SQL injection vulnerability in LOCKON CO.,LTD |
| CVE-2008-4537 | EC Ec-cube Ec-cube | – | Oct 10 | Cross-site scripting (XSS) vulnerability in EC-CUBE Ver1 1.4.6 and earlier, Ver1 Beta 1.5.0-beta and earlier, Ver2 2.1.2a and earlier, Ver2 Beta(RC) 2.1.1-beta and earlier,… |
| CVE-2008-4536 | EC Ec-cube Ec-cube | – | Oct 10 | Cross-site scripting (XSS) vulnerability in EC-CUBE Ver1 1.4.6 and earlier, Ver1 Beta 1.5.0-beta and earlier, Ver2 2.1.2a and earlier, Ver2 Beta(RC) 2.2.0-beta and earlier,… |
| CVE-2008-4535 | EC Ec-cube Ec-cube | – | Oct 10 | Cross-site scripting (XSS) vulnerability in EC-CUBE Ver2 2.1.2a and earlier, EC-CUBE Ver2 Beta(RC) 2.2.0-beta and earlier, and EC-CUBE Community Edition Nighly-Build r17623 and… |
| CVE-2008-4534 | EC Ec-cube Ec-cube | – | Oct 10 | SQL injection vulnerability in EC-CUBE Ver2 2.1.2a and earlier, and Ver2 RC 2.3.0-rc1 and earlier, allows remote attackers to execute arbitrary SQL commands via unspecified… |
| CVE-2006-6108 | EC Ec-cube Ec-cube | – | Nov 26 | Cross-site scripting (XSS) vulnerability in EC-CUBE before 1.0.1a-beta allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors |