CVE-2006-0922
CubeCart 3.0 through 3.6 does not properly check authorization for an administration session...
CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, which results in an absolute path traversal vulnerability in FileUpload in connector.php (aka upload.php) that allows remote attackers to upload arbitrary files via a modified CurrentFolder parameter in a direct request to admin/filemanager/upload.php.
Exploit likelihood
What each source reports
NVD Score used
CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, which results in an absolute path traversal vulnerability in FileUpload in connector.php (aka upload.php) that allows remote attackers to upload arbitrary files via a modified CurrentFolder parameter in a direct request to admin/filemanager/upload.php.
- Record
CVE-2006-0922- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, which results in an absolute path traversal vulnerability in FileUpload in connector.php (aka upload.php) that allows remote attackers to upload arbitrary files via a modified CurrentFolder parameter in a direct request to admin/filemanager/upload.php.
- Record
CVE-2006-0922- Updated
- 2026-11-02
EUVDEUVD-2006-0926 No score
CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, which results in an absolute path traversal vulnerability in FileUpload in connector.php (aka upload.php) that allows remote attackers to upload arbitrary files via a modified CurrentFolder parameter in a direct request to admin/filemanager/upload.php.
- Record
EUVD-2006-0926- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-frjw-hc7c-8r47 No score
CubeCart 3.0 through 3.6 does not properly check authorization for an administration session...
CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, which results in an absolute path traversal vulnerability in FileUpload in connector.php (aka upload.php) that allows remote attackers to upload arbitrary files via a modified CurrentFolder parameter in a direct request to admin/filemanager/upload.php.
- Record
GHSA-frjw-hc7c-8r47- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | CubeCart 3.0.x - Arbitrary File Upload | 2006-02-23 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-0922 is a medium vulnerability (CVSS 5.0) in Devellion Cubecart, published February 28, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.15%, the 94th percentile. No source names a fixed version.