Skip to content
OpenAdvisories

Package · Packagist

ec-cube/ec-cube

15 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

15 results · Feed

  • Medium 6.7
    GHSA-7rhv-h82h-vpjh

    EC-CUBE has a Vulnerability that Allows MFA Bypass in the Administrative Interface

    # Vulnerability Allowing MFA Bypass ## Affected EC-CUBE Versions Versions: 4.1.0 – 4.3.1 ## Vulnerability Overview If an administrator’s ID and password are compromised, an issue exists that allows an attacker to bypass the normally required two-factor authen…

    ec-cube/ec-cube Packagist
  • Low 2.7
    CVE-2022-40199

    EC-CUBE Directory traversal vulnerability

    Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an administrative privilege to obtain the product's directory structure information.

    EC-CUBE EC-CUBE 3 series and EC-CUBE 4 series ec-cube/ec-cube Packagist
  • Medium 5.4
    CVE-2022-38975

    EC-CUBE DOM-based cross-site scripting vulnerability

    DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an administrative user of the product to visit a specially crafted page.

    EC-CUBE EC-CUBE 4 series ec-cube/ec-cube Packagist
  • Medium 5.3
    CVE-2022-25355

    EC-CUBE improperly handles HTTP Host header values

    EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE use…

    EC-CUBE EC-CUBE 3 series and EC-CUBE 4 series ec-cube/ec-cube Packagist
  • Medium 6.5
    CVE-2021-20842

    EC-CUBE Cross-site request forgery (CSRF) vulnerability

    Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page.

    EC-CUBE EC-CUBE 2 series ec-cube/ec-cube Packagist
  • Medium 6.5
    CVE-2021-20841

    EC-CUBE Improper access control in Management screen

    Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors.

    EC-CUBE EC-CUBE 2 series ec-cube/ec-cube Packagist
  • Medium 6.1
    CVE-2021-20751

    EC-CUBE Cross-site scripting vulnerability

    Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation.

    EC-CUBE EC-CUBE ec-cube/ec-cube Packagist
  • Medium 6.1
    CVE-2021-20750

    EC-CUBE Cross-site scripting vulnerability

    Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted pa…

    EC-CUBE EC-CUBE ec-cube/ec-cube Packagist
  • Medium 6.1
    CVE-2021-20717 Public exploit

    EC-CUBE Cross-site scripting vulnerability

    Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution…

    EC-CUBE EC-CUBE ec-cube/ec-cube Packagist
  • High 7.5
    CVE-2020-5680

    EC-CUBE Improper input validation vulnerability

    Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vector.

    EC-CUBE EC-CUBE ec-cube/ec-cube Packagist
  • Medium 6.1
    CVE-2020-5679

    EC-CUBE Improper Restriction of Rendered UI Layers or Frames

    Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted.

    EC-CUBE EC-CUBE ec-cube/ec-cube Packagist
  • High 8.1
    CVE-2020-5590

    EC-CUBE Directory traversal vulnerability

    Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors.

    EC-CUBE EC-CUBE ec-cube/ec-cube Packagist
  • Medium 6.1
    CVE-2018-16191

    EC-CUBE Open redirect vulnerability

    Open redirect vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3.0.4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0.7, EC-CUBE 3.0.8, EC-CUBE 3.0.9, EC-CUBE 3.0.10, EC-CUBE 3.0.11, EC-CUBE 3.0.12, EC-CUBE 3.0.12-p1, EC…

    LOCKON EC-CUBE ec-cube/ec-cube Packagist
  • Critical 9.1
    CVE-2014-0808

    EC-CUBE vulnerable to authorization bypass

    Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users' informati…

    EC-CUBE S‑cubism EC-CUBE EC-Orange Packagist
  • Medium —
    CVE-2011-0451

    EC-CUBE XSS Vulnerabilities

    Multiple cross-site scripting (XSS) vulnerabilities in (1) data/Smarty/templates/default/list.tpl and (2) data/Smarty/templates/default/campaign/bloc/cart_tag.tpl in EC-CUBE before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via unspec…

    ec-cube/ec-cube Packagist