Vulnerability · Published Sep 17, 2026 · Assigned by GitHub_M

CVE-2026-54646CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php

High 7.2

In plain English

A high-severity SQL injection in v6 from cubecart. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)1.4%top 26.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated administrator can terminate the quoted identifier with a closing backtick and introduce attacker-controlled structural SQL, potentially compromising database confidentiality, integrity, and availability within the application's database privileges. This issue is fixed in version 6.7.5.

Affected products (as reported)

Vendor	Product	Versions
cubecart	v6	< 6.7.5

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/cubecart/v6/security/advisories/GHSA-qcx6-cg43-ffmx x_refsource_CONFIRM
https://github.com/cubecart/v6/commit/fc08d55628191969f2345d06d862df316f7d44d3 x_refsource_MISC
https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php x_refsource_MISC
https://github.com/cubecart/v6/releases/tag/6.7.5 x_refsource_MISC