Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-54645

CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass

CVSS 3.1 4.8 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-54645

Published

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, description_short, and spec_copy rich-text fields from $GLOBALS['RAW']['POST'] and removes only script elements before the values are stored and rendered through Smarty templates. An administrator with product-editing rights can store event-handler attributes, SVG content, or javascript: URIs that bypass this filter, causing persistent JavaScript execution when a storefront visitor or another administrator views the product content and enabling session exposure or unauthorized browser-context actions. This issue is fixed in version 6.7.5.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-54645

Published

v6

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "cubecart",
                    "product": "v6",
                    "versions": [
                        {
                            "version": "< 6.7.5",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON