CubeCart vulnerabilities
We track 11 vulnerabilities in CubeCart products across 2 products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on September 17, 2026.
Latest CubeCart vulnerabilities
- 7.2 High severity
v6: Improper Neutralization of Special Elements used in an SQL Command
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled download_expire POST parameter into a raw UPDATE statement for CubeCart_downloads without numeric validation. An
- 7.2 High severity
v6: Improper Neutralization of Special Elements used in an SQL Command
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embe
- 9.1 Critical severity
v6: Improper Control of Generation of Code
CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of CubeCart (including Email Templates, Invoices, Documents, and Contact Forms). The application unsafel
- 7.2 High severity
v6: Improper Control of Generation of Code
CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw <?php … ?> into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print.<md5>.php. f
- 8.1 High severity
CubeCart is an ecommerce software solution.
CubeCart is an ecommerce software solution. Prior to 6.7.2, CubeCart 6.6.x – 6.7.1 builds CC_STORE_URL directly from the Host request header at bootstrap, with no allowlist. The constant is embedded verbatim into transactional email links, most critically the
- 9.1 Critical severity
v6: Unrestricted Upload of File with Dangerous Type
CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Arbitrary File Upload vulnerability exists in the REST API File Manager endpoint (POST /api/v1/files) of CubeCart. The endpoint allows any holder of an API key with files:rw permissio
- 9.1 Critical severity
v6: Improper Control of Generation of Code
CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of CubeCart (including Email Templates and Documents). The application unsafely evaluates user-supplied
- 7.2 High severity
v6: Improper Neutralization of Special Elements used in an SQL Command
CubeCart is an ecommerce software solution. Prior to 6.6.0, Authenticated Time-Based Blind SQL Injection vulnerabilities were identified in the sorting parameters (sort[price], sort_activity, sort_admin, and sort_customer) of the Products and Logs endpoints in
- 8.6 High severity
CubeCart: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to execute an arbitrary OS command.
- 7.1 High severity
CubeCart is an ecommerce software solution.
CubeCart is an ecommerce software solution. Prior to version 6.5.11, there is an absence of automatic session expiration following a user's password change. This oversight poses a security risk, as if a user forgets to log out from a location where they access
- 9.8 Critical severity
cubecart: Improper Limitation of a Pathname to a Restricted Directory
Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to the _g and node parameters.