CVE-2025-59411 CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry

CubeCart is an ecommerce software solution. Prior to version 6.5.11, the contact form’s Enquiry field accepts raw HTML and that HTML is included verbatim in the email sent to the store admin. By submitting HTML in the Enquiry, the admin receives an email containing that HTML. This indicates user...

CVE-2025-59411

CVE-2025-59411 affects CubeCart versions prior to 6.5.11. The Enquiry field in the contact form accepts raw HTML, which is included verbatim in emails to the store admin, indicating a lack of escaping/sanitization before output in email (and possibly on re-render). This creates a Cross‑Site Scrip...