CVE-2026-54647High· 7.2▾ MidnightPoC available

CubeCart is an ecommerce software solution

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score52/ 100 · Moderate

impact 39.6 · likelihood 0.3 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Sep 17, 2026

Updated

Sep 23, 2026

CVSS

7.2

Vendor

cubecart

Product

CWE

CWE-89

Depth score

52 · Moderate

EPSS

1.4% · p72

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-09-23

Exploit-DB: Search Exploit-DB for CVE-2026-54647 ↗

EPSS history

Exploit-prediction probability, daily snapshots since Sep 19.

1.4% → 1.4%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 7 days

Sep 17, 2026Published
Disclosed via NVD
Sep 19, 2026EPSS first tracked
1.4%
Sep 23, 2026Record revised
Last analysed / modified upstream
Sep 23, 2026Public exploit observed
Exploit-DB (last check)

cubecart CWE-89 #nvd #exploit-available #cve.org

Affected

v6 < 6.7.5

Full technical detail▾

Overview

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled download_expire POST parameter into a raw UPDATE statement for CubeCart_downloads without numeric validation. An authenticated administrator can supply a comma-delimited value that changes the SET clause because HTML sanitization does not neutralize SQL syntax, allowing manipulation of database columns and potentially other data within the application's database privileges. This issue is fixed in version 6.7.5.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#exploit-available#cve.org

← Back to feed