{"id":"CVE-2026-54645","title":"CubeCart is an ecommerce software solution","summary":"CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, description_short, and spec_copy rich-text fields from $GLOBALS['RAW']['POST'] and removes only script elements befor…","severity":"medium","cvss":4.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"cubecart","product":"v6","affected":["v6 < 6.7.5"],"published":"2026-09-17","updated":"2026-09-24","sourceUpdated":"2026-09-24T21:25:27.050","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54645","references":[{"url":"https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php","label":"security-advisories@github.com"},{"url":"https://github.com/cubecart/v6/commit/bd2dcdcc7da55a3731fe288b54cac8bfa3d9142a","label":"security-advisories@github.com"},{"url":"https://github.com/cubecart/v6/commit/f7abe7484691a33abcbc0806fca59d605024a75c","label":"security-advisories@github.com"},{"url":"https://github.com/cubecart/v6/releases/tag/6.7.5","label":"security-advisories@github.com"},{"url":"https://github.com/cubecart/v6/security/advisories/GHSA-43f6-gfcf-wj9c","label":"security-advisories@github.com"},{"url":"https://github.com/cubecart/v6/security/advisories/GHSA-43f6-gfcf-wj9c","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","exploit-available","cve.org"],"epss":0.01124,"epssPercentile":0.64812,"exploits":{"exploitdb":true,"checkedAt":"2026-09-24T21:53:34.700Z"},"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-22T01:57:37.586309Z"},"ingestedAt":"2026-09-17T22:30:21.403Z","slug":"CVE-2026-54645","body":"## Overview\n\nCubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, description_short, and spec_copy rich-text fields from $GLOBALS['RAW']['POST'] and removes only script elements before the values are stored and rendered through Smarty templates. An administrator with product-editing rights can store event-handler attributes, SVG content, or javascript: URIs that bypass this filter, causing persistent JavaScript execution when a storefront visitor or another administrator views the product content and enabling session exposure or unauthorized browser-context actions. This issue is fixed in version 6.7.5.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":26.4,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[]}