High severity · published Sep 17, 2026
CVE-2026-54646
CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php
7.2
CVSS
1.4%
EPSS
No
On KEV
Description
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated administrator can terminate the quoted identifier with a closing backtick and introduce attacker-controlled structural SQL, potentially compromising database confidentiality, integrity, and availability within the application's database privileges. This issue is fixed in version 6.7.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
V6
v6 · cubecart
< 6.7.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-54646
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-54646
github.com
https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php
github.com
https://github.com/cubecart/v6/commit/fc08d55628191969f2345d06d862df316f7d44d3
github.com
https://github.com/cubecart/v6/releases/tag/6.7.5
github.com
https://github.com/cubecart/v6/security/advisories/GHSA-qcx6-cg43-ffmx
More from v6
9.1
CVE-2026-45714
CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
9.1
CVE-2026-45053
CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API
9.1
CVE-2026-44377
CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
8.1
CVE-2026-45055
CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header
7.2
CVE-2026-54647
CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php