CVE-2026-54646

🗓️ 17 Sep 2026 22:01:53Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 53 Views🌐 WEB

Authenticated SQL injection in CubeCart prior to 6.7.5 via backtick bypass compromising database.

Reporter	Title	Published	Views	Family All 8
Cvelist	CVE-2026-54646 CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php	17 Sep 202622:01	–	cvelist
Exploit DB	CubeCart 6.7.4 - SQL	31 Aug 202600:00	–	exploitdb
EUVD	EUVD-2026-82527	17 Sep 202622:01	–	euvd
NVD	CVE-2026-54646	17 Sep 202622:17	–	nvd
Packet Storm	CubeCart 6.7.4 SQL Injection	31 Aug 202600:00	–	packetstorm
Positive Technologies	PT-2026-95154	17 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-54646: Improper Neutralization of Special Elements used in an SQL Command	17 Sep 202600:00	–	rapid7
Vulnrichment	CVE-2026-54646 CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php	17 Sep 202622:01	–	vulnrichment

Vulners

Node

cubecart cubecartRange<6.7.5

[
  {
    "vendor": "cubecart",
    "product": "v6",
    "versions": [
      {
        "version": "< 6.7.5",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/cubecart/v6/releases/tag/6.7.5
github	www.github.com/cubecart/v6/security/advisories/GHSA-qcx6-cg43-ffmx
github	www.github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php
github	www.github.com/cubecart/v6/commit/fc08d55628191969f2345d06d862df316f7d44d3

Parameter	Position	Path	Description	CWE
table name	request body	/admin/sources/maintenance.index.inc.php	SQL injection via identifier injection in structural SQL statements (ALTER, CHECK, ANALYZE) due to lack of backtick escaping.	CWE-89
download_expire	request body	/admin/sources/settings.index.inc.php	SQL injection via comma injection in an UPDATE statement because the global sanitizer does not filter commas.	CWE-89

23 Sep 2026 19:43Current

6Medium risk

Vulners AI Score6

CVSS 3.17.2

EPSS0.01447

SSVC

CWE-89