# cve.now: Cubecart

The newest entries naming Cubecart as an affected vendor (up to 200), of 29 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-54645](https://cve.now/CVE-2026-54645.md): CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass (CVSS 4.8)
- [CVE-2026-54643](https://cve.now/CVE-2026-54643.md): CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php (CVSS 5.4)
- [CVE-2026-54642](https://cve.now/CVE-2026-54642.md): CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php (CVSS 5.3)
- [CVE-2026-54644](https://cve.now/CVE-2026-54644.md): CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System (CVSS 6.1)
- [CVE-2026-54647](https://cve.now/CVE-2026-54647.md): CubeCart : SQL Injection via download\_expire Parameter in settings.index.inc.php (CVSS 7.2)
- [CVE-2026-54646](https://cve.now/CVE-2026-54646.md): CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php (CVSS 7.2)
- [CVE-2026-54648](https://cve.now/CVE-2026-54648.md): CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion (CVSS 6.5)
- [CVE-2026-45708](https://cve.now/CVE-2026-45708.md): CubeCart: Authenticated RCE via Invoice Template → Order Print (CVSS 7.2)
- [CVE-2026-45055](https://cve.now/CVE-2026-45055.md): CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header (CVSS 8.1)
- [CVE-2026-45714](https://cve.now/CVE-2026-45714.md): CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE (CVSS 9.1)
- [CVE-2026-45054](https://cve.now/CVE-2026-45054.md): CubeCart: Authenticated SQL Injection via \`sort\[\]\` Parameter in Admin Orders Transactions Listing (CVSS 4.9)
- [CVE-2026-45053](https://cve.now/CVE-2026-45053.md): CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API (CVSS 9.1)
- [CVE-2026-44376](https://cve.now/CVE-2026-44376.md): CubeCart: Reflected XSS in Store Search Bar (CVSS 6.1)
- [CVE-2026-39428](https://cve.now/CVE-2026-39428.md): CubeCart: Stored Cross-Site Scripting (XSS) (CVSS 4.8)
- [CVE-2026-39358](https://cve.now/CVE-2026-39358.md): CubeCart: Time-based Blind SQL Injection (CVSS 7.2)
- [CVE-2026-44377](https://cve.now/CVE-2026-44377.md): CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE (CVSS 9.1)
- [CVE-2026-35496](https://cve.now/CVE-2026-35496.md): A path traversal vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to access higher-l (CVSS 2.7)
- [CVE-2026-34018](https://cve.now/CVE-2026-34018.md): An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the p (CVSS 6.3)
- [CVE-2026-21719](https://cve.now/CVE-2026-21719.md): An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to execute (CVSS 7.2)
- [CVE-2025-59413](https://cve.now/CVE-2025-59413.md): CubeCart Unauthorized Newsletter Unsubscription via force\_unsubscribe Parameter (CVSS 6.5)
- [CVE-2025-59412](https://cve.now/CVE-2025-59412.md): CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacement (CVSS 5.4)
- [CVE-2025-59411](https://cve.now/CVE-2025-59411.md): CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry (CVSS 5.4)
- [CVE-2025-59335](https://cve.now/CVE-2025-59335.md): CubeCart Session Not Invalidated After Password Change (CVSS 7.1)
- [CVE-2023-47675](https://cve.now/CVE-2023-47675.md): CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command. (no CVSS)
- [CVE-2023-47283](https://cve.now/CVE-2023-47283.md): Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to obta (no CVSS)
- [CVE-2023-42428](https://cve.now/CVE-2023-42428.md): Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to dele (no CVSS)
- [CVE-2023-38130](https://cve.now/CVE-2023-38130.md): Cross-site request forgery (CSRF) vulnerability in CubeCart prior to 6.5.3 allows a remote unauthenticated attacker to delete data in the sy (no CVSS)
- [CVE-2017-2117](https://cve.now/CVE-2017-2117.md): Directory traversal vulnerability in CubeCart versions prior to 6.1.5 allows attacker with administrator rights to read arbitrary files via (no CVSS)
- [CVE-2017-2098](https://cve.now/CVE-2017-2098.md): Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unsp (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/cubecart
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.