Cubecart vulnerabilities
29 CVEs and advisories name Cubecart as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-54645CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass
- CVE-2026-54643CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php
- CVE-2026-54642CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php
- CVE-2026-54644CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System
- CVE-2026-54647CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php
- CVE-2026-54646CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php
- CVE-2026-54648CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion
- CVE-2026-45708CubeCart: Authenticated RCE via Invoice Template → Order Print
- CVE-2026-45055CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header
- CVE-2026-45714CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
- CVE-2026-45054CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listing
- CVE-2026-45053CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API
- CVE-2026-44376CubeCart: Reflected XSS in Store Search Bar
- CVE-2026-39428CubeCart: Stored Cross-Site Scripting (XSS)
- CVE-2026-39358CubeCart: Time-based Blind SQL Injection
- CVE-2026-44377CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
- CVE-2026-35496A path traversal vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to access higher-l
- CVE-2026-34018An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the p
- CVE-2026-21719An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to execute
- CVE-2025-59413CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter
- CVE-2025-59412CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacement
- CVE-2025-59411CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry
- CVE-2025-59335CubeCart Session Not Invalidated After Password Change
- CVE-2023-47675CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command.
- CVE-2023-47283Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to obta
- CVE-2023-42428Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to dele
- CVE-2023-38130Cross-site request forgery (CSRF) vulnerability in CubeCart prior to 6.5.3 allows a remote unauthenticated attacker to delete data in the sy
- CVE-2017-2117Directory traversal vulnerability in CubeCart versions prior to 6.1.5 allows attacker with administrator rights to read arbitrary files via
- CVE-2017-2098Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unsp