What’s Vulnerable › Products

cubecart v6 vulnerabilities

16 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 16 published in the last 12 months.

Check whether your cubecart v6 version is affected

Latest cubecart v6 vulnerabilities

• CVE-2026-54648 — CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion (CVSS 6.5)
• CVE-2026-54647 — CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php (CVSS 7.2)
• CVE-2026-54646 — CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php (CVSS 7.2)
• CVE-2026-54645 — CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass (CVSS 4.8)
• CVE-2026-54644 — CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System (CVSS 6.1)
• CVE-2026-54643 — CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php (CVSS 5.4)
• CVE-2026-54642 — CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php (CVSS 5.3)
• CVE-2026-45714 — CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE (CVSS 9.1)
• CVE-2026-45708 — CubeCart: Authenticated RCE via Invoice Template → Order Print (CVSS 7.2)
• CVE-2026-45055 — CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header (CVSS 8.1)
• CVE-2026-45054 — CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listing (CVSS 4.9)
• CVE-2026-45053 — CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API (CVSS 9.1)
• CVE-2026-44377 — CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE (CVSS 9.1)
• CVE-2026-44376 — CubeCart: Reflected XSS in Store Search Bar (CVSS 6.1)
• CVE-2026-39428 — CubeCart: Stored Cross-Site Scripting (XSS) (CVSS 4.8)
• CVE-2026-39358 — CubeCart: Time-based Blind SQL Injection (CVSS 7.2)