Skip to content
OpenAdvisories

Vendor

cubecart

29 known vulnerabilities.

Products

v6 20 CubeCart 9
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-45714

    CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE

    CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of CubeCart (including Email Templates, Invoices, Documents, and Contact Forms). The application unsafe…

    cubecart v6
  • Critical 9.1
    CVE-2026-45053

    CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API

    CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Arbitrary File Upload vulnerability exists in the REST API File Manager endpoint (POST /api/v1/files) of CubeCart. The endpoint allows any holder of an API key with files:rw permissi…

    cubecart v6
  • Critical 9.1
    CVE-2026-44377

    CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE

    CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of CubeCart (including Email Templates and Documents). The application unsafely evaluates user-supplied…

    cubecart v6