CVE-2021-20717

CVE-2021-20717-EC-CUBE-XSS NVD Description Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script...

CVE-2013-3651

CVE-2013-3651 PoC - EC-CUBE 2 Usage Requirements Python 3 Execution $ python poccve20133651.py - e.g. $ python poccve20133651.py http://127.0.0.1:9000/ Result: Vulnerable! PoC Vulnerability | EC-CUBE, an open platform for building and renewing e-commerce sites...

CVE-2026-103671

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...

EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin" vulnerable to external control of assumed-immutable web parameter

Overview EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin provided by EC-CUBE CO.,LTD. contains the following vulnerability. External Control of Assumed-Immutable Web Parameter CWE-472 - CVE-2026-103671 The developer states that attacks exploiting the vulnerability has been observed. EC-CUBE...

CVE-2026-103671

A vulnerability exists in the AmazonPay Plugin for the EC-CUBE 4 series due to an external control of an assumed-immutable web parameter (CWE-472). If exploited, an attacker can redirect users to an arbitrary website during the ordering process, potentially leading to the theft of user account in...

EUVD-2026-100939

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...

CVE-2026-103671

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...

CVE-2026-103671: External Control of Assumed-Immutable Web Parameter

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...

VulnCheck KEV: CVE-2026-103671

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...

PT-2026-113722

Name of the Vulnerable Software and Affected Versions AmazonPay Plugin for EC-CUBE 4 series affected versions not specified Description An issue exists where an assumed-immutable web parameter is under external control. This allows an attacker to redirect users to an arbitrary website during the...

CVE-2026-30777

EC-CUBE provided by EC-CUBE CO.,LTD. contains a multi-factor authentication MFA bypass vulnerability. An attacker who has obtained a valid administrator ID and password may be able to bypass two-factor authentication and gain unauthorized access to the administrative page...

GHSA-7RHV-H82H-VPJH EC-CUBE has a Vulnerability that Allows MFA Bypass in the Administrative Interface

Vulnerability Allowing MFA Bypass Affected EC-CUBE Versions Versions: 4.1.0 – 4.3.1 Vulnerability Overview If an administrator’s ID and password are compromised, an issue exists that allows an attacker to bypass the normally required two-factor authentication 2FA and log in to the administrative...

EC-CUBE has a Vulnerability that Allows MFA Bypass in the Administrative Interface

Vulnerability Allowing MFA Bypass Affected EC-CUBE Versions Versions: 4.1.0 – 4.3.1 Vulnerability Overview If an administrator’s ID and password are compromised, an issue exists that allows an attacker to bypass the normally required two-factor authentication 2FA and log in to the administrative...

EUVD-2026-9791

EC-CUBE provided by EC-CUBE CO.,LTD. contains a multi-factor authentication MFA bypass vulnerability. An attacker who has obtained a valid administrator ID and password may be able to bypass two-factor authentication and gain unauthorized access to the administrative page...

CVE-2026-30777

EC-CUBE provided by EC-CUBE CO.,LTD. contains a multi-factor authentication MFA bypass vulnerability. An attacker who has obtained a valid administrator ID and password may be able to bypass two-factor authentication and gain unauthorized access to the administrative page...

CVE-2026-30777

EC-CUBE provided by EC-CUBE CO.,LTD. contains a multi-factor authentication MFA bypass vulnerability. An attacker who has obtained a valid administrator ID and password may be able to bypass two-factor authentication and gain unauthorized access to the administrative page...

CVE-2026-30777

EC-CUBE provided by EC-CUBE CO.,LTD. contains a multi-factor authentication MFA bypass vulnerability. An attacker who has obtained a valid administrator ID and password may be able to bypass two-factor authentication and gain unauthorized access to the administrative page...

CVE-2026-30777

EC-CUBE (EC-CUBE CO.,LTD.) contains a vulnerability that allows MFA bypass. An attacker with valid administrator credentials may bypass two-factor authentication and gain unauthorized access to the administrative page. The connected CVE records confirm the issue and describe the impact as unautho...

CVE-2026-30777

EC-CUBE provided by EC-CUBE CO.,LTD. contains a multi-factor authentication MFA bypass vulnerability. An attacker who has obtained a valid administrator ID and password may be able to bypass two-factor authentication and gain unauthorized access to the administrative page...

EC-CUBE vulnerable to multi-factor authentication bypass

Overview EC-CUBE provided by EC-CUBE CO.,LTD. contains the following vulnerability. Authentication bypass using an alternate path or channel CWE-288 - CVE-2026-30777 EC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LT...