Skip to content
Cubecart vulnerabilities
Newest
-
cubecart v6
CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass
CVE-2026-54645
Public exploit
4.8 Medium
-
cubecart v6
CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php
CVE-2026-54643
5.4 Medium
-
cubecart v6
CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php
CVE-2026-54642
5.3 Medium
-
cubecart v6
CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System
CVE-2026-54644
Public exploit
6.1 Medium
-
cubecart v6
CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php
CVE-2026-54647
Public exploit
7.2 High
-
cubecart v6
CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php
CVE-2026-54646
Public exploit
7.2 High
-
cubecart v6
CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion
CVE-2026-54648
6.5 Medium
-
cubecart v6
CubeCart: Authenticated RCE via Invoice Template → Order Print
CVE-2026-45708
7.2 High
-
cubecart v6
CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header
CVE-2026-45055
8.1 High
-
cubecart v6
CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
CVE-2026-45714
9.1 Critical
-
cubecart v6
CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listing
CVE-2026-45054
4.9 Medium
-
cubecart v6
CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API
CVE-2026-45053
9.1 Critical
-
cubecart v6
CubeCart: Reflected XSS in Store Search Bar
CVE-2026-44376
Public exploit
6.1 Medium
-
cubecart v6
CubeCart: Stored Cross-Site Scripting (XSS)
CVE-2026-39428
4.8 Medium
-
cubecart v6
CubeCart: Time-based Blind SQL Injection
CVE-2026-39358
7.2 High
-
cubecart v6
CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
CVE-2026-44377
9.1 Critical
-
cubecart
A path traversal vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an...
CVE-2026-35496
5.1 Medium
-
cubecart
An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to...
CVE-2026-34018
5.1 Medium
-
cubecart
An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user...
CVE-2026-21719
8.6 High
-
cubecart, cubecart v6 +1 more
CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter
CVE-2025-59413
6.5 Medium
-
cubecart, cubecart v6 +1 more
CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacement
CVE-2025-59412
5.4 Medium
-
cubecart, cubecart v6 +1 more
CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry
CVE-2025-59411
5.4 Medium
-
cubecart, cubecart v6 +1 more
CubeCart Session Not Invalidated After Password Change
CVE-2025-59335
7.1 High
-
cubecart
Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute...
CVE-2024-34832
Public exploit
9.8 Critical
-
cubecart
File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to execute...
CVE-2024-33438
Public exploit
8.0 High
-
cubecart
CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege...
CVE-2023-47675
7.2 High
-
cubecart
Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated...
CVE-2023-47283
4.9 Medium
-
cubecart
Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated...
CVE-2023-42428
6.5 Medium
-
cubecart
Cross-site request forgery (CSRF) vulnerability in CubeCart prior to 6.5.3 allows a remote...
CVE-2023-38130
8.1 High
-
cubecart
Cubecart 6.4.2 allows Session Fixation. The application does not generate a new session cookie...
CVE-2021-33394
5.4 Medium
-
cubecart
CubeCart before 6.1.13 has SQL Injection via the validate[] parameter of the "I forgot my...
CVE-2018-20716
9.8 Critical
-
cubecart
CubeCart 6.2.2 has Reflected XSS via a /{ADMIN-FILE}/ query string.
CVE-2018-20703
5.4 Medium
-
cubecart
Directory traversal vulnerability in CubeCart versions prior to 6.1.5 allows attacker with...
CVE-2017-2117
4.9 Medium
-
cubecart
Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated...
CVE-2017-2098
6.5 Medium
-
cubecart, cybozu, inc. cybozu garoon +1 more
Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated...
CVE-2017-2090
6.5 Medium
-
cubecart
classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly...
CVE-2015-6928
6.8 Medium
-
cubecart
Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web...
CVE-2014-2341
Public exploit
6.8 Medium
-
cubecart
The Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows...
CVE-2013-1465
Public exploit
9.8 Critical
-
cubecart
Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to...
CVE-2012-0865
Public exploit
5.8 Medium
-
cubecart
SQL injection vulnerability in index.php in CubeCart 4.3.3 allows remote attackers to execute...
CVE-2010-4903
7.5 High
-
cubecart
CubeCart 4.4.3 allows remote attackers to obtain sensitive information via a direct request to a ...
CVE-2011-3724
5.0 Medium
-
cubecart
SQL injection vulnerability in includes/content/cart.inc.php in CubeCart PHP Shopping cart 4.3.4...
CVE-2010-1931
Public exploit
7.5 High
-
cubecart
SQL injection vulnerability in includes/content/viewProd.inc.php in CubeCart before 4.3.7 remote...
CVE-2009-4060
Public exploit
7.5 High
-
cubecart
classes/session/cc_admin_session.php in CubeCart 4.3.4 does not properly restrict administrative...
CVE-2009-3904
Public exploit
7.5 High
-
cubecart
Multiple cross-site scripting (XSS) vulnerabilities in index.php in CubeCart 4.2.1 allow remote...
CVE-2008-1550
4.3 Medium