VULNERABILITY

CVE search

Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.

Severity

CríticoAltoMédioBaixoExploited in the wild (KEV)

Language / ecosystem

JavaScript / TypeScript (npm)Python (PyPI)PHP (Packagist)Java / Kotlin (Maven)GoRuby (RubyGems).NET (NuGet)

Stack

JavaScript / Node.js

Next.jsNuxtReactAngularSvelte / SvelteKitAstroRemixViteExpressNestJSFastifyNode.jsaxios

PHP

LaravelSymfonyPHP

Python

DjangoFlaskFastAPI / Starlette

Ruby

Ruby on Rails

Java

Spring

GinFiber

CMS

WordPressWooCommerceDrupalGhostStrapi

Servers & databases

nginxApache HTTP ServerMySQLPostgreSQLRedis

Vendor1

ec-cubeoracleibmgoogleadobemicrosoftmozillaciscoapacheappleredhatjenkinshpAll vendors →

ec-cube products

ec-cube 25business form output 2ec-cube payment module 2amazon pay 1delivery slip number 1delivery slip number csv bulk registration 1delivery slip number mail 1discount coupon 1e-mail newsletter management 1ec-cube ver2 1email newsletters management 1product image bulk upload 1

402.604 vulnerabilities · 1.766 actively exploited (CISA KEV)

ec-cube ✕Clear filters

36 results

ID	Severity	Summary	Published
CVE-2021-20717	MÉDIO6.1	Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser.	10/05/2021
CVE-2020-5680	ALTO7.5	Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vector.	03/12/2020
CVE-2020-5679	MÉDIO6.1	Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted.