CVE-2026-45714 | Critical | 9.1 | 2026-05-13 | CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of… |
CVE-2026-45708 | High | 7.2 | 2026-05-13 | CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw <?php … ?> into the Invoice Editor. The next t… |
CVE-2026-45055 | High | 8.1 | 2026-05-13 | CubeCart is an ecommerce software solution. Prior to 6.7.2, CubeCart 6.6.x – 6.7.1 builds CC_STORE_URL directly from the Host request header at bootstrap, with… |
CVE-2026-45054 | Medium | 4.9 | 2026-05-13 | CubeCart is an ecommerce software solution. Prior to 6.7.0, the admin orders-transactions listing page (admin.php?_g=orders&node=transactions) builds a raw ORD… |
CVE-2026-45053 | Critical | 9.1 | 2026-05-13 | CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Arbitrary File Upload vulnerability exists in the REST API File Manager endpoint (… |
CVE-2026-44377 | Critical | 9.1 | 2026-05-13 | CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of… |
CVE-2026-44376 | Medium | 6.1 | 2026-05-13 | CubeCart is an ecommerce software solution. Prior to 6.7.0, an unauthenticated Reflected XSS vulnerability exists in the CubeCart v6.x search feature. Due to a… |
CVE-2026-39428 | Medium | 4.8 | 2026-05-13 | CubeCart is an ecommerce software solution. Prior to 6.6.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in CubeCart v6.x. An attacker with adminis… |
CVE-2026-39358 | High | 7.2 | 2026-05-13 | CubeCart is an ecommerce software solution. Prior to 6.6.0, Authenticated Time-Based Blind SQL Injection vulnerabilities were identified in the sorting paramet… |
CVE-2026-35496 | Low | 2.7 | 2026-04-17 | A path traversal vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to access higher-level directories th… |
CVE-2026-34018 | Critical | 9.8 | 2026-04-17 | An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the product. |
CVE-2026-21719 | High | 7.2 | 2026-04-17 | An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to execute an arbitrary OS com… |
CVE-2025-59413 | Medium | 6.5 | 2025-09-22 | CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to uns… |
CVE-2025-59412 | Medium | 5.4 | 2025-09-22 | CubeCart is an ecommerce software solution. Prior to version 6.5.11, a vulnerability exists in the product reviews feature where user-supplied input is not pro… |
CVE-2025-59411 | Medium | 5.4 | 2025-09-22 | CubeCart is an ecommerce software solution. Prior to version 6.5.11, the contact form’s Enquiry field accepts raw HTML and that HTML is included verbatim in th… |
CVE-2025-59335 | High | 7.1 | 2025-09-22 | CubeCart is an ecommerce software solution. Prior to version 6.5.11, there is an absence of automatic session expiration following a user's password change. Th… |
CVE-2024-34832 | Critical | 9.8 | 2024-06-06 | Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to the _g and node pa… |
CVE-2024-33438 | High | 8.0 | 2024-04-29 | File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to execute arbitrary code via a crafted .phar file. |
CVE-2023-47675 | High | 7.2 | 2023-11-17 | CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command. |
CVE-2023-47283 | Medium | 4.9 | 2023-11-17 | Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to obtain files in the sys… |
CVE-2023-42428 | Medium | 6.5 | 2023-11-17 | Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to delete directories and… |
CVE-2023-38130 | High | 8.1 | 2023-11-17 | Cross-site request forgery (CSRF) vulnerability in CubeCart prior to 6.5.3 allows a remote unauthenticated attacker to delete data in the system. |
CVE-2021-33394 | Medium | 5.4 | 2021-05-27 | Cubecart 6.4.2 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create… |
CVE-2018-20716 | Critical | 9.8 | 2019-01-15 | CubeCart before 6.1.13 has SQL Injection via the validate[] parameter of the "I forgot my Password!" feature. |
CVE-2018-20703 | Medium | 5.4 | 2019-01-13 | CubeCart 6.2.2 has Reflected XSS via a /{ADMIN-FILE}/ query string. |
CVE-2017-2117 | Medium | 4.9 | 2017-04-28 | Directory traversal vulnerability in CubeCart versions prior to 6.1.5 allows attacker with administrator rights to read arbitrary files via unspecified vectors. |
CVE-2017-2098 | Medium | 6.5 | 2017-04-28 | Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors. |
CVE-2017-2090 | Medium | 6.5 | 2017-04-28 | Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors. |
CVE-2015-6928 | | | 2015-09-28 | classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was made, which allows… |
CVE-2014-2341 | | | 2014-04-22 | Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID parameter. |
CVE-2013-1465 | Critical | 9.8 | 2013-02-08 | The Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows remote attackers to unserialize arbitrary PHP objects via a c… |
CVE-2012-0865 | | | 2012-02-21 | Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing atta… |
CVE-2010-4903 | | | 2011-10-08 | SQL injection vulnerability in index.php in CubeCart 4.3.3 allows remote attackers to execute arbitrary SQL commands via the searchStr parameter. |
CVE-2011-3724 | | | 2011-09-23 | CubeCart 4.4.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error mes… |
CVE-2010-1931 | | | 2010-06-10 | SQL injection vulnerability in includes/content/cart.inc.php in CubeCart PHP Shopping cart 4.3.4 through 4.3.9 allows remote attackers to execute arbitrary SQL… |
CVE-2009-4060 | | | 2009-11-24 | SQL injection vulnerability in includes/content/viewProd.inc.php in CubeCart before 4.3.7 remote attackers to execute arbitrary SQL commands via the productId… |
CVE-2009-3904 | | | 2009-11-06 | classes/session/cc_admin_session.php in CubeCart 4.3.4 does not properly restrict administrative access permissions, which allows remote attackers to bypass re… |
CVE-2008-1550 | | | 2008-03-31 | Multiple cross-site scripting (XSS) vulnerabilities in index.php in CubeCart 4.2.1 allow remote attackers to inject arbitrary web script or HTML via (1) the _a… |