Skip to content
OpenAdvisories

Vendor

cubecart

29 known vulnerabilities.

Products

v6 20 CubeCart 9
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.2
    CVE-2026-54647 Public exploit

    CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php

    CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled download_expire POST parameter into a raw UPDATE statement for CubeCart_downloads without numeric validation. A…

    cubecart v6
  • High 7.2
    CVE-2026-54646 Public exploit

    CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php

    CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping emb…

    cubecart v6