Cubecart V6 vulnerabilities

• cubecart v6 CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass CVE-2026-54645 Public exploit 4.8 MediumSeptember 17, 2026
• cubecart v6 CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php CVE-2026-54643 5.4 MediumSeptember 17, 2026
• cubecart v6 CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php CVE-2026-54642 5.3 MediumSeptember 17, 2026
• cubecart v6 CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System CVE-2026-54644 Public exploit 6.1 MediumSeptember 17, 2026
• cubecart v6 CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php CVE-2026-54647 Public exploit 7.2 HighSeptember 17, 2026
• cubecart v6 CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php CVE-2026-54646 Public exploit 7.2 HighSeptember 17, 2026
• cubecart v6 CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion CVE-2026-54648 6.5 MediumSeptember 17, 2026
• cubecart v6 CubeCart: Authenticated RCE via Invoice Template → Order Print CVE-2026-45708 7.2 HighMay 13, 2026
• cubecart v6 CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header CVE-2026-45055 8.1 HighMay 13, 2026
• cubecart v6 CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE CVE-2026-45714 9.1 CriticalMay 13, 2026
• cubecart v6 CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listing CVE-2026-45054 4.9 MediumMay 13, 2026
• cubecart v6 CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API CVE-2026-45053 9.1 CriticalMay 13, 2026
• cubecart v6 CubeCart: Reflected XSS in Store Search Bar CVE-2026-44376 Public exploit 6.1 MediumMay 13, 2026
• cubecart v6 CubeCart: Stored Cross-Site Scripting (XSS) CVE-2026-39428 4.8 MediumMay 13, 2026
• cubecart v6 CubeCart: Time-based Blind SQL Injection CVE-2026-39358 7.2 HighMay 13, 2026
• cubecart v6 CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE CVE-2026-44377 9.1 CriticalMay 13, 2026
• cubecart, cubecart v6 +1 more CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter CVE-2025-59413 6.5 MediumSeptember 22, 2025
• cubecart, cubecart v6 +1 more CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacement CVE-2025-59412 5.4 MediumSeptember 22, 2025
• cubecart, cubecart v6 +1 more CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry CVE-2025-59411 5.4 MediumSeptember 22, 2025
• cubecart, cubecart v6 +1 more CubeCart Session Not Invalidated After Password Change CVE-2025-59335 7.1 HighSeptember 22, 2025