CVEs we hold for Cubecart

Records whose assigning authority named Cubecart as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-54648CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletioncubecart v6

CVE-2026-54647CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.phpcubecart v6

CVE-2026-54646CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.phpcubecart v6

CVE-2026-54645CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypasscubecart v6

CVE-2026-54644CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message Systemcubecart v6

CVE-2026-54643CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.phpcubecart v6

CVE-2026-54642CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.phpcubecart v6

CVE-2026-45714CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCEcubecart v6

CVE-2026-45708CubeCart: Authenticated RCE via Invoice Template → Order Printcubecart v6

CVE-2026-45055CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Headercubecart v6

CVE-2026-45054CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listingcubecart v6

CVE-2026-45053CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files APIcubecart v6

CVE-2026-44377CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCEcubecart v6

CVE-2026-44376CubeCart: Reflected XSS in Store Search Barcubecart v6

CVE-2026-39428CubeCart: Stored Cross-Site Scripting (XSS)cubecart v6

CVE-2026-39358CubeCart: Time-based Blind SQL Injectioncubecart v6

CVE-2026-35496no title heldCubeCart

CVE-2026-34018no title heldCubeCart

CVE-2026-21719no title heldCubeCart

CVE-2025-59413CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parametercubecart v6

CVE-2025-59412CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacementcubecart v6

CVE-2025-59411CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquirycubecart v6

CVE-2025-59335CubeCart Session Not Invalidated After Password Changecubecart v6

CVE-2023-47675no title heldCubeCart

CVE-2023-47283no title heldCubeCart

CVE-2023-42428no title heldCubeCart

CVE-2023-38130no title heldCubeCart

CVE-2017-2117no title heldCubeCart

CVE-2017-2098no title heldCubeCart

29 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.