EUVD-2026-30172

CubeCart is an ecommerce software solution. Prior to 6.7.2, CubeCart 6.6.x – 6.7.1 builds CCSTOREURL directly from the Host request header at bootstrap, with no allowlist. The constant is embedded verbatim into transactional email links, most critically the password-reset link in...

EUVD-2026-30156

CubeCart is an ecommerce software solution. Prior to 6.6.0, Authenticated Time-Based Blind SQL Injection vulnerabilities were identified in the sorting parameters sortprice, sortactivity, sortadmin, and sortcustomer of the Products and Logs endpoints in CubeCart v6.x. This allows an attacker to...

CVE-2024-34832

Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to the g and node parameters...

EUVD-2017-11274

Malware in sbrugna...

EUVD-2011-3682

Malware in sbrugna...

EUVD-2005-0607

Malware in sbrugna...

EUVD-2005-0443

Malware in sbrugna...

EUVD-2017-11281

Malware in sbrugna...

EUVD-2005-0444

Malware in sbrugna...

EUVD-2018-13250

Malware in sbrugna...

EUVD-2021-20100

Malware in sbrugna...

EUVD-2023-51411

Malicious code in bioql PyPI...

EUVD-2023-41955

Malicious code in bioql PyPI...

EUVD-2023-46880

Malicious code in bioql PyPI...

CVE-2024-33438

File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to execute arbitrary code via a crafted .phar file...

CVE-2023-42428

Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to delete directories and files in the system...

CVE-2023-38130

Cross-site request forgery CSRF vulnerability in CubeCart prior to 6.5.3 allows a remote unauthenticated attacker to delete data in the system...

CVE-2023-47283

Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to obtain files in the system...

CVE-2018-20703

CubeCart 6.2.2 has Reflected XSS via a /ADMIN-FILE/ query string...

CVE-2006-4527

includes/content/gateway.inc.php in CubeCart 3.0.12 and earlier, when magicquotesgpc is disabled, uses an insufficiently restrictive regular expression to validate the gateway parameter, which allows remote attackers to conduct PHP remote file inclusion attacks...