CVE-2026-54646: high-severity vulnerability in cubecart v6
CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 7.2epss 1.4%
from disclosure to weaponsame day
Published on NVDSep 17
1st PoCAug 31
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated administrator can terminate the quoted identifier with a closing backtick and introduce attacker-controlled structural SQL, potentially compromising database confidentiality, integrity, and availability within the application's database privileges. This issue is fixed in version 6.7.5.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
cubecart · v6public PoCs found — 1
exploitdbwww.exploit-db.com/exploits/52663unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — cubecart v6
In the same product, most dangerous first.
CVE-2026-54647HIGHCubeCart : SQL Injection via download_expire Parameter in settings.index.inc.phpEPSS 1.4%CVE-2026-54645MEDIUMCubeCart: Stored XSS in Product Description Editor via Global Sanitizer BypassEPSS 1.1%CVE-2026-54644MEDIUMCubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message SystemEPSS 0.9%CVE-2026-44377CRITICALCubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCEEPSS 0.7%CVE-2026-44376MEDIUMCubeCart: Reflected XSS in Store Search BarEPSS 0.7%CVE-2026-54648MEDIUMCubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data DeletionEPSS 0.6%