EC
Vendor
EC-CUBE CO.,LTD.
21
CVEs
0
On KEV
4
New 30D
Products
AP4.7
AmazonPay Plugin (4.0 series)
EC-CUBE CO.,LTD.
1 CVEs0 on KEV1 new
AV4.7
AmazonPay V2 Plugin (4.0/4.1 series)
EC-CUBE CO.,LTD.
1 CVEs0 on KEV1 new
AV4.7
AmazonPay V2 Plugin (4.2/4.3 series)
EC-CUBE CO.,LTD.
1 CVEs0 on KEV1 new
AV4.7
AmazonPay V2 Plugin (4.2/4.3 series, Bundle Edition)
EC-CUBE CO.,LTD.
1 CVEs0 on KEV1 new
E47.2
EC-CUBE 4 series
EC-CUBE CO.,LTD.
5 CVEs0 on KEV0 new
E35.3
EC-CUBE 3 series and EC-CUBE 4 series
EC-CUBE CO.,LTD.
2 CVEs0 on KEV0 new
E24.8
EC-CUBE 2 series
EC-CUBE CO.,LTD.
1 CVEs0 on KEV0 new
E37.2
EC-CUBE 3 series
EC-CUBE CO.,LTD.
1 CVEs0 on KEV0 new
E46.5
EC-CUBE 4.1 series
EC-CUBE CO.,LTD.
1 CVEs0 on KEV0 new
E46.5
EC-CUBE 4.2 series
EC-CUBE CO.,LTD.
1 CVEs0 on KEV0 new
E46.5
EC-CUBE 4.3 series
EC-CUBE CO.,LTD.
1 CVEs0 on KEV0 new
E45.4
EC-CUBE 4 series, EC-CUBE 3 series, and EC-CUBE 2 series
EC-CUBE CO.,LTD.
1 CVEs0 on KEV0 new
EP4.3
EC-CUBE plugin 'Mail Magazine Management Plugin'
EC-CUBE CO.,LTD.
1 CVEs0 on KEV0 new
EW6.1
EC-CUBE Web API Plugin
EC-CUBE CO.,LTD.
1 CVEs0 on KEV0 new
EW6.1
EC-CUBE Web API Plugin (4.2 series)
EC-CUBE CO.,LTD.
1 CVEs0 on KEV0 new
PI9.8
Product Image Bulk Upload Plugin
EC-CUBE CO.,LTD.
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-103671 | AV AmazonPay V2 Plugin (4.2/4.3 series, Bundle Edition) EC-CUBE CO.,LTD. | 4.7 | Oct 14 | External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin" |
| CVE-2026-30777 | E4 EC-CUBE 4.1 series EC-CUBE CO.,LTD. | 6.5 | Mar 5 | EC-CUBE provided by EC-CUBE CO.,LTD |
| CVE-2024-41924 | E4 EC-CUBE 4 series EC-CUBE CO.,LTD. | 7.2 | Jul 30 | Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series |
| CVE-2024-41141 | EW EC-CUBE Web API Plugin EC-CUBE CO.,LTD. | 6.1 | Jul 30 | Stored cross-site scripting vulnerability exists in EC-CUBE Web API Plugin |
| CVE-2023-46845 | E3 EC-CUBE 3 series EC-CUBE CO.,LTD. | 7.2 | Nov 7 | EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper… |
| CVE-2023-40281 | E2 EC-CUBE 2 series EC-CUBE CO.,LTD. | 4.8 | Aug 17 | EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page |
| CVE-2023-25077 | E4 EC-CUBE 4 series EC-CUBE CO.,LTD. | 5.4 | Mar 5 | Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote authenticated attacker… |
| CVE-2023-22438 | E4 EC-CUBE 4 series, EC-CUBE 3 series, and EC-CUBE 2 series EC-CUBE CO.,LTD. | 5.4 | Mar 5 | Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0), EC-CUBE 3 series (EC-CUBE… |
| CVE-2023-22838 | E4 EC-CUBE 4 series EC-CUBE CO.,LTD. | 5.4 | Mar 5 | Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote… |
| CVE-2022-40199 | E3 EC-CUBE 3 series and EC-CUBE 4 series EC-CUBE CO.,LTD. | 2.7 | Sep 27 | Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an… |
| CVE-2022-38975 | E4 EC-CUBE 4 series EC-CUBE CO.,LTD. | 5.4 | Sep 27 | DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an administrative user… |
| CVE-2022-37346 | PI Product Image Bulk Upload Plugin EC-CUBE CO.,LTD. | 9.8 | Sep 27 | EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files |
| CVE-2022-25355 | E3 EC-CUBE 3 series and EC-CUBE 4 series EC-CUBE CO.,LTD. | 5.3 | Feb 24 | EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version… |
| CVE-2022-21179 | EP EC-CUBE plugin 'Mail Magazine Management Plugin' EC-CUBE CO.,LTD. | 4.3 | Feb 24 | Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0.4 (for EC-CUBE 3… |