Mọi CVE đã công bố cùng các advisory mã nguồn mở (NVD, OSV, GitHub), kèm CVSS, EPSS và cho biết lỗ hổng có đang bị khai thác thực tế hay không (CISA KEV). Cập nhật mỗi vài giờ. Các bài quét đối chiếu dữ liệu này với công nghệ phát hiện được trên site.
| 22/09/2025 |
| CVE-2025-59412 | TRUNG BÌNH5.4 | CubeCart is an ecommerce software solution. Prior to version 6.5.11, a vulnerability exists in the product reviews feature where user-supplied input is not properly sanitized before being displayed. An attacker can submit HTML tags inside the review description field. Once the administrator approves the review, the inj | 22/09/2025 |
| CVE-2025-59411 | TRUNG BÌNH5.4 | CubeCart is an ecommerce software solution. Prior to version 6.5.11, the contact form’s Enquiry field accepts raw HTML and that HTML is included verbatim in the email sent to the store admin. By submitting HTML in the Enquiry, the admin receives an email containing that HTML. This indicates user input is not being esca | 22/09/2025 |
| CVE-2025-59335 | CAO7.1 | CubeCart is an ecommerce software solution. Prior to version 6.5.11, there is an absence of automatic session expiration following a user's password change. This oversight poses a security risk, as if a user forgets to log out from a location where they accessed their account, an unauthorized user can maintain access e | 22/09/2025 |
| CVE-2024-34832 | NGHIÊM TRỌNG9.8 | Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to the _g and node parameters. | 06/06/2024 |
| CVE-2024-33438 | CAO8.0 | File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to execute arbitrary code via a crafted .phar file. | 29/04/2024 |
| CVE-2023-47675 | CAO7.2 | CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command. | 17/11/2023 |
| CVE-2023-47283 | TRUNG BÌNH4.9 | Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to obtain files in the system. | 17/11/2023 |
| CVE-2023-42428 | TRUNG BÌNH6.5 | Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to delete directories and files in the system. | 17/11/2023 |
| CVE-2023-38130 | CAO8.1 | Cross-site request forgery (CSRF) vulnerability in CubeCart prior to 6.5.3 allows a remote unauthenticated attacker to delete data in the system. | 17/11/2023 |
| CVE-2021-33394 | TRUNG BÌNH5.4 | Cubecart 6.4.2 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid, giving the attacker access to the user's accou | 27/05/2021 |
| CVE-2018-20716 | NGHIÊM TRỌNG9.8 | CubeCart before 6.1.13 has SQL Injection via the validate[] parameter of the "I forgot my Password!" feature. | 15/01/2019 |
| CVE-2018-20703 | TRUNG BÌNH5.4 | CubeCart 6.2.2 has Reflected XSS via a /{ADMIN-FILE}/ query string. | 13/01/2019 |
| CVE-2017-2117 | TRUNG BÌNH4.9 | Directory traversal vulnerability in CubeCart versions prior to 6.1.5 allows attacker with administrator rights to read arbitrary files via unspecified vectors. | 28/04/2017 |
| CVE-2017-2098 | TRUNG BÌNH6.5 | Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors. | 28/04/2017 |
| CVE-2017-2090 | TRUNG BÌNH6.5 | Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors. | 28/04/2017 |
| CVE-2015-6928 | TRUNG BÌNH6.8 | classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was made, which allows remote attackers to change the administrator password via a recovery request with a space character in the validate parameter and the administrator email in the | 28/09/2015 |