Vulnerability · Published Sep 22, 2025 · Assigned by GitHub_M

CVE-2025-59412CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacement

Medium 5.4

In plain English

A medium-severity cross-site scripting in v6 from cubecart. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 78.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

CubeCart is an ecommerce software solution. Prior to version 6.5.11, a vulnerability exists in the product reviews feature where user-supplied input is not properly sanitized before being displayed. An attacker can submit HTML tags inside the review description field. Once the administrator approves the review, the injected HTML is rendered on the product page for all visitors. This could be used to redirect users to malicious websites or to display unwanted content. This issue has been patched in version 6.5.11.

Affected products (as reported)

Vendor	Product	Versions
cubecart	v6	< 6.5.11

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/cubecart/v6/security/advisories/GHSA-qfrx-vvvp-h5m2 x_refsource_CONFIRM
https://github.com/cubecart/v6/commit/1a0c0d8f6c9c141575eb5be07d04e7d49820005b x_refsource_MISC
https://github.com/cubecart/v6/commit/7d4bf593304332fa1258d4f0b10dd7c9f6283a86 x_refsource_MISC