Skip to content
OpenAdvisories

Vendor

cubecart

29 known vulnerabilities.

Products

v6 20 CubeCart 9
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.8
    CVE-2026-54645 Public exploit

    CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass

    CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, description_short, and spec_copy rich-text fields from $GLOBALS['RAW']['POST'] and removes only script elements before the values are store…

    cubecart v6
  • Medium 6.1
    CVE-2026-54644 Public exploit

    CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System

    CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip_tags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. …

    cubecart v6
  • Medium 6.1
    CVE-2026-44376 Public exploit

    CubeCart: Reflected XSS in Store Search Bar

    CubeCart is an ecommerce software solution. Prior to 6.7.0, an unauthenticated Reflected XSS vulnerability exists in the CubeCart v6.x search feature. Due to a logic flaw in classes/catalogue.class.php, user input is reflected without sanitization only when a…

    cubecart v6