Approved changes feed: RSS · Atom
cpe:2.3:a:cubecart:cubecart:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Cubecart (44edadd4-1b03-5b62-abed-d31a151c61cb) |
|---|---|
| Product | Cubecart (68614c97-75c1-5a61-b1e5-be7c2a586c24) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/cubecart/v4 |
purl2cpe | 2026-06-01 10:11:41.966262 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-35496 |
vulnerable | 2026-06-08 07:59:14.058554 |
Details available
LOW (2.7)
A path traversal vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to access higher-level directories that should not be accessible.
Published: 2026-04-17T04:33:49.813Z
Updated: 2026-04-17T12:18:33.735Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34018 |
vulnerable | 2026-06-08 07:59:11.691210 |
Details available
MEDIUM (6.3)
An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the product.
Published: 2026-04-17T04:33:35.768Z
Updated: 2026-04-17T12:20:12.217Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-21719 |
vulnerable | 2026-06-08 07:49:16.710834 |
Details available
HIGH (7.2)
An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to execute an arbitrary OS command.
Published: 2026-04-17T04:33:17.708Z
Updated: 2026-04-17T12:21:48.770Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-59413 |
vulnerable | 2026-06-08 07:35:21.862836 |
CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter
MEDIUM (6.5)
CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber’s email address. This issue has been patched in version 6.5.11.
Published: 2025-09-22T16:15:00.351Z
Updated: 2025-09-22T17:26:29.173Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-59412 |
vulnerable | 2026-06-08 07:35:21.862550 |
CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacement
MEDIUM (5.4)
CubeCart is an ecommerce software solution. Prior to version 6.5.11, a vulnerability exists in the product reviews feature where user-supplied input is not properly sanitized before being displayed. An attacker can submit HTML tags inside the review description field. Once the administrator approves the review, the injected HTML is rendered on the product page for all visitors. This could be used to redirect users to malicious websites or to display unwanted content. This issue has been patched in version 6.5.11.
Published: 2025-09-22T16:14:44.152Z
Updated: 2025-09-22T17:26:36.393Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-59411 |
vulnerable | 2026-06-08 07:35:21.862263 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-59335 |
vulnerable | 2026-06-08 07:35:21.681286 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-34832 |
vulnerable | 2026-06-08 06:37:35.101562 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-33438 |
vulnerable | 2026-06-08 06:37:31.151998 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-47675 |
vulnerable | 2026-06-08 06:14:25.364235 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-47283 |
vulnerable | 2026-06-08 06:14:24.613912 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-42428 |
vulnerable | 2026-06-08 06:11:08.044470 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-38130 |
vulnerable | 2026-06-08 06:08:16.954220 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-20716 |
vulnerable | 2026-06-08 05:11:27.774915 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-2117 |
vulnerable | 2026-06-08 05:09:23.630851 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-2098 |
vulnerable | 2026-06-08 05:09:23.578952 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-2090 |
vulnerable | 2026-06-08 05:09:23.537445 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-2341 |
vulnerable | 2026-06-08 05:05:28.517665 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-1465 |
vulnerable | 2026-06-08 05:03:54.066851 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-0865 |
vulnerable | 2026-06-08 05:00:46.019594 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2009-4060 |
vulnerable | 2026-06-08 04:51:46.774447 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.