Vulnerability · Published May 13, 2026 · Assigned by GitHub_M

CVE-2026-39358CubeCart: Time-based Blind SQL Injection

High 7.2

In plain English

A high-severity SQL injection in v6 from cubecart. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.3%top 76.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

CubeCart is an ecommerce software solution. Prior to 6.6.0, Authenticated Time-Based Blind SQL Injection vulnerabilities were identified in the sorting parameters (sort[price], sort_activity, sort_admin, and sort_customer) of the Products and Logs endpoints in CubeCart v6.x. This allows an attacker to execute arbitrary SQL commands, compromising the confidentiality and integrity of the database. This vulnerability is fixed in 6.6.0.

Affected products (as reported)

Vendor	Product	Versions
cubecart	v6	< 6.6.0

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/cubecart/v6/security/advisories/GHSA-8gj6-9fwc-h4gh x_refsource_CONFIRM