📄 Cubecart 6.5.9 Cross Site Scripting

Cubecart version 6.5.9 suffers from a persistent cross site scripting vulnerability. Exploit Title: Stored XSS in "Description" Functionality - cubecartv6.5.9 Date: 05/2025 Exploit Author: Andrey Stoykov Version: 6.5.9 Tested on: Debian 12 Blog: https://msecureltd.blogspot.com/ Stored XSS 1: Step...

CVE-2024-34832

Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to the g and node parameters...

CVE-2024-34832

Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to the g and node parameters...

CVE-2024-34832

CVE-2024-34832 is a directory traversal vulnerability in CubeCart v6.5.5 and earlier that enables arbitrary code execution via crafted uploads to the _g and node parameters. Multiple sources describe the flaw: the admin panel can be abused to include .inc.php files located anywhere on the server,...

CVE-2024-34832

Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to the g and node parameters...

CVE-2024-34832

Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to the g and node parameters...

Devellion CubeCart Security Breach

Devellion CubeCart is a free and open source e-commerce shopping cart software from the company of Devellion UK. The software supports selling products, adding/editing products or images in an online store, etc. A security vulnerability exists in Devellion CubeCart v.6.5.5 and earlier versions,...

PT-2024-26229 · Cubecart · Cubecart

Name of the Vulnerable Software and Affected Versions: CubeCart versions 6.5.5 and earlier Description: The issue allows an attacker to execute arbitrary code via a crafted file uploaded to the g and node parameters. This enables the attacker to potentially access and manipulate sensitive data or...

CVE-2024-33438

File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to execute arbitrary code via a crafted .phar file...

Devellion CubeCart 安全漏洞

Devellion CubeCart is a free and open source e-commerce shopping cart software from the company of Devellion UK. The software supports selling products, adding/editing products or images, etc. in an online store. A security vulnerability exists in Devellion CubeCart versions prior to 6.5.5, which...

CVE-2024-33438

File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to execute arbitrary code via a crafted .phar file...

CVE-2024-33438

CubeCart versions prior to 6.5.5 are vulnerable to an arbitrary file upload flaw in the application's file manager . The vulnerability exists because filters can be bypassed to upload malicious .phar files, which leads to remote code execution (RCE) by an authenticated user. Remediation involves ...

PT-2024-25259 · Cubecart · Cubecart

Name of the Vulnerable Software and Affected Versions: CubeCart versions prior to 6.5.5 Description: The issue allows an authenticated user to execute arbitrary code via a crafted .phar file. This is a result of a File Upload vulnerability. Recommendations: For versions prior to 6.5.5, update to...

CVE-2024-33438

File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to execute arbitrary code via a crafted .phar file...

CVE-2024-33438

File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to execute arbitrary code via a crafted .phar file...

Exploit for Unrestricted Upload of File with Dangerous Type in Cubecart

Arbitrary File Upload Leads to RCE CVE-2024-33438 CubeCart &...

Multiple vulnerabilities in CubeCart

Overview CubeCart provided by CubeCart Limited contains multiple vulnerabilities listed below. Cross-site request forgery CWE-352 - CVE-2023-38130 Directory traversal CWE-22 - CVE-2023-42428 Directory traversal CWE-22 - CVE-2023-47283 OS command injection CWE-78 - CVE-2023-47675 Gen Sato of Mitsu...

CVE-2023-47675

CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command...

CVE-2023-38130

Cross-site request forgery CSRF vulnerability in CubeCart prior to 6.5.3 allows a remote unauthenticated attacker to delete data in the system...

CVE-2023-47283

Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to obtain files in the system...