CVE-2026-54644mediumCWE-79

CVE-2026-54644: fallo de gravedad media en cubecart v6

CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System

Publicada el · Actualizada el

Seguir esta CVE

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 6.1epss 0.9%
de la publicación al armael mismo día
Publicada en NVD17 sept
1ª PoC31 ago
CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip_tags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data that reaches a GUI message can carry a javascript: URI or event handler through the filter, and viewing or interacting with the rendered anchor executes JavaScript in the victim's browser session, enabling session exposure or unauthorized application actions. This issue is fixed in version 6.7.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
cubecart · v6
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — cubecart v6

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-54647HIGHCubeCart : SQL Injection via download_expire Parameter in settings.index.inc.phpEPSS 1.4%CVE-2026-54646HIGHCubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.phpEPSS 1.4%CVE-2026-54645MEDIUMCubeCart: Stored XSS in Product Description Editor via Global Sanitizer BypassEPSS 1.1%CVE-2026-44377CRITICALCubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCEEPSS 0.7%CVE-2026-44376MEDIUMCubeCart: Reflected XSS in Store Search BarEPSS 0.7%CVE-2026-54648MEDIUMCubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data DeletionEPSS 0.6%