Ec-Cube Co.,ltd.
26 CVEs across 16 Ec-Cube Co.,ltd. products. Browse Ec-Cube Co.,ltd. vulnerabilities, severities, and proof-of-concept exploits.
Ec-Cube Co.,ltd. products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-30777 | Medium | 6.5 | 2026-03-05 | EC-CUBE provided by EC-CUBE CO.,LTD. contains a multi-factor authentication (MFA) bypass vulnerability. An attacker who has obtained a valid administrator ID a… |
CVE-2024-41924 | High | 7.2 | 2024-07-30 | Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series. If this vulnerability is exploited, an attacker who obtaine… |
CVE-2024-41141 | Medium | 6.1 | 2024-07-30 | Stored cross-site scripting vulnerability exists in EC-CUBE Web API Plugin. When there are multiple users using OAuth Management feature and one of them inputs… |
CVE-2023-46845 | High | 7.2 | 2023-11-07 | EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability… |
CVE-2023-40281 | Medium | 4.8 | 2023-08-17 | EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. If this vulnerability i… |
CVE-2023-25077 | Medium | 5.4 | 2023-03-06 | Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote au… |
CVE-2023-22838 | Medium | 5.4 | 2023-03-06 | Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0… |
CVE-2023-22438 | Medium | 5.4 | 2023-03-06 | Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0), EC-CUB… |
CVE-2022-40199 | Low | 2.7 | 2022-09-27 | Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated… |
CVE-2022-38975 | Medium | 5.4 | 2022-09-27 | DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an a… |
CVE-2022-37346 | Critical | 9.8 | 2022-09-27 | EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vul… |
CVE-2022-25355 | Medium | 5.3 | 2022-02-24 | EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the… |
CVE-2022-21179 | Medium | 4.3 | 2022-02-24 | Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1… |
CVE-2021-20842 | Medium | 6.5 | 2021-11-24 | Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and… |
CVE-2021-20841 | Medium | 6.5 | 2021-11-24 | Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to al… |
CVE-2021-20778 | High | 7.5 | 2021-07-01 | Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive informatio… |
CVE-2021-20751 | Medium | 6.1 | 2021-06-28 | Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an… |
CVE-2021-20750 | Medium | 6.1 | 2021-06-28 | Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote at… |
CVE-2021-20744 | Medium | 6.1 | 2021-06-22 | Cross-site scripting vulnerability in EC-CUBE Category contents plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.1 allows a remote attacker to inj… |
CVE-2021-20743 | Medium | 6.1 | 2021-06-22 | Cross-site scripting vulnerability in EC-CUBE Email newsletters management plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.4 allows a remote atta… |
CVE-2021-20742 | Medium | 6.1 | 2021-06-22 | Cross-site scripting vulnerability in EC-CUBE Business form output plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.1 allows a remote attacker to… |
CVE-2021-20717 | Medium | 6.1 | 2021-05-10 | Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the E… |
CVE-2020-5680 | High | 7.5 | 2020-12-03 | Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) condition via unsp… |
CVE-2020-5679 | Medium | 6.1 | 2020-12-03 | Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially cra… |
CVE-2020-5590 | High | 8.1 | 2020-06-19 | Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or director… |
CVE-2014-0808 | Critical | 9.1 | 2014-01-22 | Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this v… |