V6
Product
v6
20
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 3High 6Medium 11Low 0
Watch
Add v6 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-45714 | 9.1 | May 13 | CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE Affected: < 6.7.0 |
| CVE-2026-45053 | 9.1 | May 13 | CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API Affected: < 6.7.0 |
| CVE-2026-44377 | 9.1 | May 13 | CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE Affected: < 6.7.0 |
| CVE-2026-45055 | 8.1 | May 13 | CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header Affected: < 6.7.2 |
| CVE-2026-54647 | 7.2 | Sep 17 | CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php Affected: < 6.7.5 |
| CVE-2026-54646 | 7.2 | Sep 17 | CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php Affected: < 6.7.5 |
| CVE-2026-45708 | 7.2 | May 13 | CubeCart: Authenticated RCE via Invoice Template → Order Print Affected: < 6.7.3 |
| CVE-2026-39358 | 7.2 | May 13 | CubeCart: Time-based Blind SQL Injection Affected: < 6.6.0 |
| CVE-2025-59335 | 7.1 | Sep 22 | CubeCart Session Not Invalidated After Password Change Affected: < 6.5.11 |
| CVE-2026-54648 | 6.5 | Sep 17 | CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion Affected: < 6.7.5 |
| CVE-2025-59413 | 6.5 | Sep 22 | CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter Affected: < 6.5.11 |
| CVE-2026-54644 | 6.1 | Sep 17 | CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System Affected: < 6.7.5 |
| CVE-2026-44376 | 6.1 | May 13 | CubeCart: Reflected XSS in Store Search Bar Affected: < 6.7.0 |
| CVE-2026-54643 | 5.4 | Sep 17 | CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php Affected: < 6.7.5 |
| CVE-2025-59412 | 5.4 | Sep 22 | CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacement Affected: < 6.5.11 |
| CVE-2025-59411 | 5.4 | Sep 22 | CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry Affected: < 6.5.11 |
| CVE-2026-54642 | 5.3 | Sep 17 | CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php Affected: < 6.7.5 |
| CVE-2026-45054 | 4.9 | May 13 | CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listing Affected: < 6.7.0 |
| CVE-2026-54645 | 4.8 | Sep 17 | CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass Affected: < 6.7.5 |
| CVE-2026-39428 | 4.8 | May 13 | CubeCart: Stored Cross-Site Scripting (XSS) Affected: < 6.6.0 |
Showing 20