1395 matches found
CVE-2026-45054
CubeCart is an ecommerce software solution. Prior to 6.7.0, the admin orders-transactions listing page admin.php?g=orders&node=transactions builds a raw ORDER BY SQL fragment from the attacker-controlled $GET'sort' array without column or direction validation. Both the column key and the directio...
CVE-2026-45708 CubeCart: Authenticated RCE via Invoice Template → Order Print
CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print..php. files/.htaccess ships an explicit allow from all...
CVE-2026-45714 CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection SSTI vulnerability exists in multiple modules of CubeCart including Email Templates, Invoices, Documents, and Contact Forms. The application unsafely evaluates user-supplied input using the...
CVE-2026-45054 CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listing
CubeCart is an ecommerce software solution. Prior to 6.7.0, the admin orders-transactions listing page admin.php?g=orders&node=transactions builds a raw ORDER BY SQL fragment from the attacker-controlled $GET'sort' array without column or direction validation. Both the column key and the directio...
CVE-2026-45054 CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listing
CubeCart is an ecommerce software solution. Prior to 6.7.0, the admin orders-transactions listing page admin.php?g=orders&node=transactions builds a raw ORDER BY SQL fragment from the attacker-controlled $GET'sort' array without column or direction validation. Both the column key and the directio...
CVE-2026-44376
CubeCart (v6.x) prior to 6.7.0 contains an unauthenticated Reflected XSS in the search feature. Root cause is a logic flaw in classes/catalogue.class.php that reflects unsanitized user input when a search returns exactly one product, bypassing existing filters. Consequences include the execution ...
CVE-2026-39358 CubeCart: Time-based Blind SQL Injection
CubeCart is an ecommerce software solution. Prior to 6.6.0, Authenticated Time-Based Blind SQL Injection vulnerabilities were identified in the sorting parameters sortprice, sortactivity, sortadmin, and sortcustomer of the Products and Logs endpoints in CubeCart v6.x. This allows an attacker to...
CubeCart cross-site scripting vulnerabilities
CubeCart is an open-source e-commerce software developed by CubeCart. Versions of CubeCart prior to 6.7.0 had a cross-site scripting vulnerability. This vulnerability stemmed from a logical flaw in the search function. When only one product was returned during a search, uncleaned user input was...
com.cedarsoftware:n-cube (>=4.0.6, <=4.0.16), org.apache.tomcat.embed:tomcat-embed-jasper (8.5.12) +2 more potentially affected by CVE-2026-42498 via org.apache.tomcat.embed:tomcat-embed-core (8.5.12)
org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.cedarsoftware:n-cube =4.0.6, =1.0.9-m3, =1.0.9-m6 Source cves:...
com.aceql:aceql-http (1.0), com.bbossgroups.boot:bboot-starter-tomcat (>=5.0.3.8.3, <=5.9.5) +12 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (8.5.24)
org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.24 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.aceql:aceql-http 1.0 - com.bbossgroups.boot:bboot-starter-tomcat...
com.cedarsoftware:n-cube (>=4.0.6, <=4.0.16), org.apache.tomcat.embed:tomcat-embed-jasper (8.5.12) +2 more potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (8.5.12)
org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.cedarsoftware:n-cube =4.0.6, =1.0.9-m3, =1.0.9-m6 Source cves:...
com.cedarsoftware:n-cube (>=4.0.6, <=4.0.16), org.apache.tomcat.embed:tomcat-embed-jasper (8.5.12) +2 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (8.5.12)
org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.cedarsoftware:n-cube =4.0.6, =1.0.9-m3, =1.0.9-m6 Source cves:...
com.cedarsoftware:n-cube (>=4.0.6, <=4.0.16), org.apache.tomcat.embed:tomcat-embed-jasper (8.5.12) +2 more potentially affected by CVE-2026-43512 via org.apache.tomcat.embed:tomcat-embed-core (8.5.12)
org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.cedarsoftware:n-cube =4.0.6, =1.0.9-m3, =1.0.9-m6 Source cves:...
com.cedarsoftware:n-cube (>=4.0.6, <=4.0.16), org.apache.tomcat.embed:tomcat-embed-jasper (8.5.12) +2 more potentially affected by CVE-2026-43514 via org.apache.tomcat.embed:tomcat-embed-core (8.5.12)
org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.cedarsoftware:n-cube =4.0.6, =1.0.9-m3, =1.0.9-m6 Source cves:...
com.cedarsoftware:n-cube (>=4.0.6, <=4.0.16), org.apache.tomcat.embed:tomcat-embed-jasper (8.5.12) +2 more potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (8.5.12)
org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.cedarsoftware:n-cube =4.0.6, =1.0.9-m3, =1.0.9-m6 Source cves:...
OESA-2026-2128 lcms2 security update
LittleCMS intends to be an OPEN SOURSE small-footprint color management engine,with special focus on accuracy and performence.It uses the International Color Consortium standard ICC, which is the modern standard when regarding to color management. The ICC specification is widely used and is...
SUSE CVE-2026-42798
Little CMS lcms2 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c...
Integer Overflow or Wraparound
Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the ParseCube function in cmscgats.c. An attacker can cause a denial of service or potentially access sensitive information by providing specially crafted input that triggers an integer overflow...
CVE-2026-42798
Little CMS (lcms2) versions 2.16–2.18 before 2.19 have an integer overflow in ParseCube within cmscgats.c. The provided documents do not include exploit details or explicit remediation steps. References show a version delta toward 2.19 (lcms2.18...lcms2.19), but the materials do not state a confi...