{"schema_version":1,"title":"CubeCart vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 16 vulnerabilities in CubeCart: 0 in the last 7 days and 7 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-54648, was published on 17 September 2026.","url":"https://junglewise.ai/threats/technologies/cubecart","json_url":"https://junglewise.ai/threats/technologies/cubecart.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/cubecart","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":5,"all_time":16,"critical":3,"exploited":0,"last_7_days":0,"last_30_days":7,"last_90_days":7,"last_365_days":16},"latest":[{"cve":"CVE-2026-54648","cvss":6.5,"epss":0.0059,"slug":"cve-2026-54648-cubecart-broken-access-control-in-gdpr-customer-purge","title":"CubeCart broken access control in GDPR customer purge","severity":"medium","exploited":false,"published_at":"2026-09-17T22:17:02.84+00:00","url":"https://junglewise.ai/threats/cve-2026-54648-cubecart-broken-access-control-in-gdpr-customer-purge"},{"cve":"CVE-2026-54647","cvss":7.2,"epss":0.0145,"slug":"cve-2026-54647-cubecart-sql-injection-in-download-expire-settings-parameter","title":"CubeCart SQL injection in download_expire settings parameter","severity":"high","exploited":false,"published_at":"2026-09-17T22:17:02.703+00:00","url":"https://junglewise.ai/threats/cve-2026-54647-cubecart-sql-injection-in-download-expire-settings-parameter"},{"cve":"CVE-2026-54646","cvss":7.2,"epss":0.0145,"slug":"cve-2026-54646-cubecart-sql-identifier-injection-in-maintenance-tools","title":"CubeCart SQL identifier injection in maintenance tools","severity":"high","exploited":false,"published_at":"2026-09-17T22:17:02.57+00:00","url":"https://junglewise.ai/threats/cve-2026-54646-cubecart-sql-identifier-injection-in-maintenance-tools"},{"cve":"CVE-2026-54645","cvss":4.8,"epss":0.0108,"slug":"cve-2026-54645-cubecart-stored-xss-in-product-description-fields","title":"CubeCart stored XSS in product description fields","severity":"medium","exploited":false,"published_at":"2026-09-17T22:17:02.42+00:00","url":"https://junglewise.ai/threats/cve-2026-54645-cubecart-stored-xss-in-product-description-fields"},{"cve":"CVE-2026-54644","cvss":6.1,"epss":0.009,"slug":"cve-2026-54644-cubecart-xss-in-gui-messages-via-unsafe-anchor-attributes","title":"CubeCart XSS in GUI messages via unsafe anchor attributes","severity":"medium","exploited":false,"published_at":"2026-09-17T22:17:02.283+00:00","url":"https://junglewise.ai/threats/cve-2026-54644-cubecart-xss-in-gui-messages-via-unsafe-anchor-attributes"},{"cve":"CVE-2026-54643","cvss":5.4,"epss":0.0038,"slug":"cve-2026-54643-cubecart-missing-delete-permission-check-in-order-notes-handler","title":"CubeCart missing delete permission check in order notes handler","severity":"medium","exploited":false,"published_at":"2026-09-17T22:17:02.147+00:00","url":"https://junglewise.ai/threats/cve-2026-54643-cubecart-missing-delete-permission-check-in-order-notes-handler"},{"cve":"CVE-2026-54642","epss":0.0033,"slug":"cve-2026-54642-cubecart-csrf-on-order-download-counter-reset-and-stored-card","title":"CubeCart CSRF on order download-counter reset and stored-card deletion","severity":"info","exploited":false,"published_at":"2026-09-17T22:17:01.997+00:00","url":"https://junglewise.ai/threats/cve-2026-54642-cubecart-csrf-on-order-download-counter-reset-and-stored-card"},{"cve":"CVE-2026-45714","cvss":9.1,"slug":"cve-2026-45714-cubecart-ssti-in-smarty-templates-leading-to-rce","title":"CubeCart SSTI in Smarty Templates leading to RCE","severity":"critical","exploited":false,"published_at":"2026-05-13T21:16:50.02+00:00","url":"https://junglewise.ai/threats/cve-2026-45714-cubecart-ssti-in-smarty-templates-leading-to-rce"},{"cve":"CVE-2026-45708","cvss":7.2,"slug":"cve-2026-45708-cubecart-php-code-injection-in-invoice-editor","title":"CubeCart PHP code injection in Invoice Editor","severity":"high","exploited":false,"published_at":"2026-05-13T21:16:49.877+00:00","url":"https://junglewise.ai/threats/cve-2026-45708-cubecart-php-code-injection-in-invoice-editor"},{"cve":"CVE-2026-45055","cvss":8.1,"slug":"cve-2026-45055-cubecart-host-header-poisoning-in-password-reset-links","title":"CubeCart Host header poisoning in password reset links","severity":"high","exploited":false,"published_at":"2026-05-13T21:16:49.437+00:00","url":"https://junglewise.ai/threats/cve-2026-45055-cubecart-host-header-poisoning-in-password-reset-links"},{"cve":"CVE-2026-45054","cvss":4.9,"slug":"cve-2026-45054-cubecart-sql-injection-in-admin-orders-transactions-listing","title":"CubeCart SQL injection in admin orders-transactions listing","severity":"medium","exploited":false,"published_at":"2026-05-13T21:16:49.27+00:00","url":"https://junglewise.ai/threats/cve-2026-45054-cubecart-sql-injection-in-admin-orders-transactions-listing"},{"cve":"CVE-2026-45053","cvss":9.1,"epss":0.0019,"slug":"cve-2026-45053-cubecart-arbitrary-file-upload-and-path-traversal-in-rest-api","title":"CubeCart arbitrary file upload and path traversal in REST API","severity":"critical","exploited":false,"published_at":"2026-05-13T21:16:49.073+00:00","url":"https://junglewise.ai/threats/cve-2026-45053-cubecart-arbitrary-file-upload-and-path-traversal-in-rest-api"},{"cve":"CVE-2026-44377","cvss":9.1,"slug":"cve-2026-44377-cubecart-ssti-in-smarty-templates-leading-to-rce","title":"CubeCart SSTI in Smarty Templates leading to RCE","severity":"critical","exploited":false,"published_at":"2026-05-13T21:16:48.33+00:00","url":"https://junglewise.ai/threats/cve-2026-44377-cubecart-ssti-in-smarty-templates-leading-to-rce"},{"cve":"CVE-2026-44376","cvss":6.1,"epss":0.0003,"slug":"cve-2026-44376-cubecart-reflected-xss-in-search-feature","title":"CubeCart reflected XSS in search feature","severity":"medium","exploited":false,"published_at":"2026-05-13T21:16:48.183+00:00","url":"https://junglewise.ai/threats/cve-2026-44376-cubecart-reflected-xss-in-search-feature"},{"cve":"CVE-2026-39428","cvss":4.8,"slug":"cve-2026-39428-cubecart-stored-xss-in-product-management-fields","title":"CubeCart stored XSS in product management fields","severity":"medium","exploited":false,"published_at":"2026-05-13T21:16:46.8+00:00","url":"https://junglewise.ai/threats/cve-2026-39428-cubecart-stored-xss-in-product-management-fields"},{"cve":"CVE-2026-39358","cvss":7.2,"slug":"cve-2026-39358-cubecart-sql-injection-in-products-and-logs-sorting-parameters","title":"CubeCart SQL injection in Products and Logs sorting parameters","severity":"high","exploited":false,"published_at":"2026-05-13T21:16:46.657+00:00","url":"https://junglewise.ai/threats/cve-2026-39358-cubecart-sql-injection-in-products-and-logs-sorting-parameters"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":7},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"CubeCart","slug":"cubecart","vendor":{"name":"CubeCart","slug":"cubecart","url":"https://junglewise.ai/threats/vendors/cubecart"},"aliases":[],"category":"cms","homepage":"https://www.cubecart.com/","repo_url":"https://github.com/cubecart/v6","description":"CubeCart is an open-source e-commerce shopping cart software solution.","url":"https://junglewise.ai/threats/technologies/cubecart"},"most_severe":[{"cve":"CVE-2026-45053","cvss":9.1,"epss":0.0019,"slug":"cve-2026-45053-cubecart-arbitrary-file-upload-and-path-traversal-in-rest-api","title":"CubeCart arbitrary file upload and path traversal in REST API","severity":"critical","exploited":false,"published_at":"2026-05-13T21:16:49.073+00:00","url":"https://junglewise.ai/threats/cve-2026-45053-cubecart-arbitrary-file-upload-and-path-traversal-in-rest-api"},{"cve":"CVE-2026-45714","cvss":9.1,"slug":"cve-2026-45714-cubecart-ssti-in-smarty-templates-leading-to-rce","title":"CubeCart SSTI in Smarty Templates leading to RCE","severity":"critical","exploited":false,"published_at":"2026-05-13T21:16:50.02+00:00","url":"https://junglewise.ai/threats/cve-2026-45714-cubecart-ssti-in-smarty-templates-leading-to-rce"},{"cve":"CVE-2026-44377","cvss":9.1,"slug":"cve-2026-44377-cubecart-ssti-in-smarty-templates-leading-to-rce","title":"CubeCart SSTI in Smarty Templates leading to RCE","severity":"critical","exploited":false,"published_at":"2026-05-13T21:16:48.33+00:00","url":"https://junglewise.ai/threats/cve-2026-44377-cubecart-ssti-in-smarty-templates-leading-to-rce"},{"cve":"CVE-2026-45055","cvss":8.1,"slug":"cve-2026-45055-cubecart-host-header-poisoning-in-password-reset-links","title":"CubeCart Host header poisoning in password reset links","severity":"high","exploited":false,"published_at":"2026-05-13T21:16:49.437+00:00","url":"https://junglewise.ai/threats/cve-2026-45055-cubecart-host-header-poisoning-in-password-reset-links"},{"cve":"CVE-2026-54647","cvss":7.2,"epss":0.0145,"slug":"cve-2026-54647-cubecart-sql-injection-in-download-expire-settings-parameter","title":"CubeCart SQL injection in download_expire settings parameter","severity":"high","exploited":false,"published_at":"2026-09-17T22:17:02.703+00:00","url":"https://junglewise.ai/threats/cve-2026-54647-cubecart-sql-injection-in-download-expire-settings-parameter"},{"cve":"CVE-2026-54646","cvss":7.2,"epss":0.0145,"slug":"cve-2026-54646-cubecart-sql-identifier-injection-in-maintenance-tools","title":"CubeCart SQL identifier injection in maintenance tools","severity":"high","exploited":false,"published_at":"2026-09-17T22:17:02.57+00:00","url":"https://junglewise.ai/threats/cve-2026-54646-cubecart-sql-identifier-injection-in-maintenance-tools"},{"cve":"CVE-2026-45708","cvss":7.2,"slug":"cve-2026-45708-cubecart-php-code-injection-in-invoice-editor","title":"CubeCart PHP code injection in Invoice Editor","severity":"high","exploited":false,"published_at":"2026-05-13T21:16:49.877+00:00","url":"https://junglewise.ai/threats/cve-2026-45708-cubecart-php-code-injection-in-invoice-editor"},{"cve":"CVE-2026-39358","cvss":7.2,"slug":"cve-2026-39358-cubecart-sql-injection-in-products-and-logs-sorting-parameters","title":"CubeCart SQL injection in Products and Logs sorting parameters","severity":"high","exploited":false,"published_at":"2026-05-13T21:16:46.657+00:00","url":"https://junglewise.ai/threats/cve-2026-39358-cubecart-sql-injection-in-products-and-logs-sorting-parameters"},{"cve":"CVE-2026-54648","cvss":6.5,"epss":0.0059,"slug":"cve-2026-54648-cubecart-broken-access-control-in-gdpr-customer-purge","title":"CubeCart broken access control in GDPR customer purge","severity":"medium","exploited":false,"published_at":"2026-09-17T22:17:02.84+00:00","url":"https://junglewise.ai/threats/cve-2026-54648-cubecart-broken-access-control-in-gdpr-customer-purge"},{"cve":"CVE-2026-54644","cvss":6.1,"epss":0.009,"slug":"cve-2026-54644-cubecart-xss-in-gui-messages-via-unsafe-anchor-attributes","title":"CubeCart XSS in GUI messages via unsafe anchor attributes","severity":"medium","exploited":false,"published_at":"2026-09-17T22:17:02.283+00:00","url":"https://junglewise.ai/threats/cve-2026-54644-cubecart-xss-in-gui-messages-via-unsafe-anchor-attributes"}],"generated_at":"2026-09-26T09:11:00.170868+00:00"}