CVE-2026-54645

🗓️ 17 Sep 2026 22:06:28Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 16 Views🌐 WEB

Admin stored XSS in CubeCart prior to 6.7.5 via global sanitizer bypass in product descriptions.

Reporter	Title	Published	Views	Family All 7
Cvelist	CVE-2026-54645 CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass	17 Sep 202622:06	–	cvelist
Exploit DB	CubeCart 6.7.4 - Stored XSS	31 Aug 202600:00	–	exploitdb
EUVD	EUVD-2026-82532	17 Sep 202622:06	–	euvd
NVD	CVE-2026-54645	17 Sep 202622:17	–	nvd
Packet Storm	CubeCart 6.7.4 Cross Site Scripting	31 Aug 202600:00	–	packetstorm
Rapid7 Vulnerability Database (full)	CVE-2026-54645: Improper Neutralization of Input During Web Page Generation	17 Sep 202600:00	–	rapid7
Vulnrichment	CVE-2026-54645 CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass	17 Sep 202622:06	–	vulnrichment

Vulners

Node

cubecart cubecartRange<6.7.5

[
  {
    "vendor": "cubecart",
    "product": "v6",
    "versions": [
      {
        "version": "< 6.7.5",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/cubecart/v6/commit/f7abe7484691a33abcbc0806fca59d605024a75c
github	www.github.com/cubecart/v6/commit/bd2dcdcc7da55a3731fe288b54cac8bfa3d9142a
github	www.github.com/cubecart/v6/security/advisories/GHSA-43f6-gfcf-wj9c
github	www.github.com/cubecart/v6/releases/tag/6.7.5
github	www.github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php

Parameter	Position	Path	Description	CWE
description	request body	admin/sources/products.index.inc.php	Stored XSS in product descriptions via unsanitized POST data in admin/products management.	CWE-79
description_short	request body	admin/sources/products.index.inc.php	Stored XSS in product descriptions via unsanitized POST data in admin/products management.	CWE-79
spec_copy	request body	admin/sources/products.index.inc.php	Stored XSS in product descriptions via unsanitized POST data in admin/products management.	CWE-79
message	query param	classes/gui.class.php	XSS in GUI message rendering due to insufficient sanitization of reflected inputs via query parameters.	CWE-79

22 Sep 2026 02:16Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.14.8

EPSS0.01265

SSVC

CWE-79