EC-CUBE 4 series vulnerabilities

2 known vulnerabilities in EC-CUBE 4 series from Ec-cube. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  EC-CUBE 4 series: Acceptance of Extraneous Untrusted Data With Trusted Data

  CVE-2024-41924Jul 30, 2024Ec-cube

  Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series. If this vulnerability is exploited, an attacker who obtained the administrative privilege may install an arbitrary PHP package. If the obsolete versions of PHP

• 7.2 High severity

  EC-CUBE 4 series: Improper Control of Generation of Code

  CVE-2023-46845Nov 7, 2023Ec-cubeEPSS 1.73%

  EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper settings of the template engine Twig included in the product. As a result, arbitrary