# cve.now: Ec-cube Co.,ltd.

The newest entries naming Ec-cube Co.,ltd. as an affected vendor (up to 200), of 27 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-103671](https://cve.now/CVE-2026-103671.md): External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". (CVSS 4.7)
- [CVE-2026-30777](https://cve.now/CVE-2026-30777.md): EC-CUBE provided by EC-CUBE CO.,LTD. (CVSS 4.9)
- [CVE-2024-41924](https://cve.now/CVE-2024-41924.md): Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series. (CVSS 7.2)
- [CVE-2024-41141](https://cve.now/CVE-2024-41141.md): Stored cross-site scripting vulnerability exists in EC-CUBE Web API Plugin. (CVSS 6.1)
- [CVE-2023-46845](https://cve.now/CVE-2023-46845.md): EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code exec (no CVSS)
- [CVE-2023-40281](https://cve.now/CVE-2023-40281.md): EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. (no CVSS)
- [CVE-2023-25077](https://cve.now/CVE-2023-25077.md): Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 (no CVSS)
- [CVE-2023-22838](https://cve.now/CVE-2023-22838.md): Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, (no CVSS)
- [CVE-2023-22438](https://cve.now/CVE-2023-22438.md): Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC- (CVSS 5.4)
- [CVE-2022-40199](https://cve.now/CVE-2022-40199.md): Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a r (CVSS 2.7)
- [CVE-2022-38975](https://cve.now/CVE-2022-38975.md): DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary sc (CVSS 5.4)
- [CVE-2022-37346](https://cve.now/CVE-2022-37346.md): EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. (CVSS 9.8)
- [CVE-2022-25355](https://cve.now/CVE-2022-25355.md): EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated att (no CVSS)
- [CVE-2022-21179](https://cve.now/CVE-2022-21179.md): Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) (no CVSS)
- [CVE-2021-20842](https://cve.now/CVE-2021-20842.md): Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication o (no CVSS)
- [CVE-2021-20841](https://cve.now/CVE-2021-20841.md): Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access re (no CVSS)
- [CVE-2021-20778](https://cve.now/CVE-2021-20778.md): Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain s (no CVSS)
- [CVE-2021-20751](https://cve.now/CVE-2021-20751.md): Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary s (no CVSS)
- [CVE-2021-20750](https://cve.now/CVE-2021-20750.md): Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) (no CVSS)
- [CVE-2021-20744](https://cve.now/CVE-2021-20744.md): Cross-site scripting vulnerability in EC-CUBE Category contents plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.1 allows a rem (no CVSS)
- [CVE-2021-20743](https://cve.now/CVE-2021-20743.md): Cross-site scripting vulnerability in EC-CUBE Email newsletters management plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.4 a (no CVSS)
- [CVE-2021-20742](https://cve.now/CVE-2021-20742.md): Cross-site scripting vulnerability in EC-CUBE Business form output plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.1 allows a (no CVSS)
- [CVE-2021-20717](https://cve.now/CVE-2021-20717.md): Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific i (no CVSS)
- [CVE-2020-5680](https://cve.now/CVE-2020-5680.md): Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) (no CVSS)
- [CVE-2020-5679](https://cve.now/CVE-2020-5679.md): Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. (no CVSS)
- [CVE-2020-5590](https://cve.now/CVE-2020-5590.md): Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary fi (no CVSS)
- [CVE-2014-0808](https://cve.now/CVE-2014-0808.md): Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29 (CVSS 9.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/ec-cube
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.