Ccubecart

Products

Exploited and recent CVEs

• CVE-2026-54645 Medium 4.8 CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass 1.1%
• CVE-2026-54643 Medium 5.4 CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php 0.4%
• CVE-2026-54642 Medium 5.3 CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php 0.3%
• CVE-2026-54644 Medium 6.1 CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System 0.9%
• CVE-2026-54647 High 7.2 CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php 1.4%
• CVE-2026-54646 High 7.2 CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php 1.4%
• CVE-2026-54648 Medium 6.5 CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion 0.6%
• CVE-2026-45708 High 7.2 CubeCart: Authenticated RCE via Invoice Template → Order Print 0.3%
• CVE-2026-45055 High 8.1 CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header 0.1%
• CVE-2026-45714 Critical 9.1 CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE 0.4%
• CVE-2026-45054 Medium 4.9 CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listing 0.2%
• CVE-2026-45053 Critical 9.1 CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API 0.6%
• CVE-2026-44376 Medium 6.1 CubeCart: Reflected XSS in Store Search Bar 0.7%
• CVE-2026-39428 Medium 4.8 CubeCart: Stored Cross-Site Scripting (XSS) 0.2%
• CVE-2026-39358 High 7.2 CubeCart: Time-based Blind SQL Injection 0.3%
• CVE-2026-44377 Critical 9.1 CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE 0.7%
• CVE-2025-59413 Medium 6.5 CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter 0.4%
• CVE-2025-59412 Medium 5.4 CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacement 0.3%
• CVE-2025-59411 Medium 5.4 CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry 0.3%
• CVE-2025-59335 High 7.1 CubeCart Session Not Invalidated After Password Change 0.2%