CVE-2026-54644

CubeCart is an ecommerce software solution. Prior to 6.7.5, the errorMessage method in classes/gui.class.php uses striptags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data...

CVE-2026-54644 CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System

CubeCart is an ecommerce software solution. Prior to 6.7.5, the errorMessage method in classes/gui.class.php uses striptags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data...

CVE-2026-54644

CubeCart (ecommerce platform) prior to 6.7.5 is vulnerable to Cross-Site Scripting (XSS) via the _errorMessage method in classes/gui.class.php. The method uses strip_tags($message, ''), which permits anchor tags but retains unsafe href attributes and onclick event handlers. Attacker-controlled se...

CVE-2026-54644 CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System

CubeCart is an ecommerce software solution. Prior to 6.7.5, the errorMessage method in classes/gui.class.php uses striptags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data...

CVE-2026-54644 CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System

CubeCart is an ecommerce software solution. Prior to 6.7.5, the errorMessage method in classes/gui.class.php uses striptags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data...

EUVD-2026-82529

CubeCart is an ecommerce software solution. Prior to 6.7.5, the errorMessage method in classes/gui.class.php uses striptags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data...

PT-2026-95152

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.5 Description The errorMessage function in classes/gui.class.php uses strip tags to allow anchor elements in error, information, and warning messages. However, it fails to filter unsafe href values and onclick...

CVE-2026-54644: Improper Neutralization of Input During Web Page Generation

CubeCart is an ecommerce software solution. Prior to 6.7.5, the errorMessage method in classes/gui.class.php uses striptags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data...

CubeCart 6.7.4 Cross Site Scripting

CubeCart version 6.7.4 suffers from multiple cross site scripting vulnerabilities. Exploit Title: CubeCart 6.7.4 - Cross-Site Scripting Attribute Injection in gui.class.php Date: 2026-06-08 Exploit Author: Mikail Kocadağ MKLKCDG Vendor Homepage: https://www.cubecart.com/ Software Link:...