cubecart vulnerabilities

CVEs per yearBy the year they were published

1. 20254
2. 202616

Newest CVEs

• CVE-2026-54645

  CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass

  cubecart · v6

  Medium4.8
• CVE-2026-54643

  CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php

  cubecart · v6

  Medium5.4
• CVE-2026-54642

  CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php

  cubecart · v6

  Medium5.3
• CVE-2026-54644

  CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System

  cubecart · v6

  Medium6.1
• CVE-2026-54647

  CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php

  cubecart · v6

  High7.2
• CVE-2026-54646

  CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php

  cubecart · v6

  High7.2
• CVE-2026-54648

  CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion

  cubecart · v6

  Medium6.5
• CVE-2026-45708

  CubeCart: Authenticated RCE via Invoice Template → Order Print

  cubecart · v6

  High7.2
• CVE-2026-45055

  CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header

  cubecart · v6

  High8.1
• CVE-2026-45714

  CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE

  cubecart · v6

  Critical9.1