Ec-cube vulnerabilities
We track 3 vulnerabilities in Ec-cube products across 5 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on July 30, 2024.
Latest Ec-cube vulnerabilities
- 7.2 High severity
EC-CUBE 4 series: Acceptance of Extraneous Untrusted Data With Trusted Data
Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series. If this vulnerability is exploited, an attacker who obtained the administrative privilege may install an arbitrary PHP package. If the obsolete versions of PHP
- 7.2 High severity
EC-CUBE 4 series: Improper Control of Generation of Code
EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper settings of the template engine Twig included in the product. As a result, arbitrary
- 9.8 Critical severity
Product Image Bulk Upload Plugin: Unrestricted Upload of File with Dangerous Type
EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files.