by Kastro
Paper/Archive/CVE-2026-34018

CVE-2026-34018

CubeCart Limited CubeCart — An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on th…

EPSS 0.2%CVSS 9.8
critical.is priorityof 100
31
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 7.5.075 × 201.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the product.

Affected

ProductAffectedFixed inSource
CubeCartprior to 6.6.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
jpcert (CNA)6.3CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
jpcert (CNA)5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refcommunity.cubecart.com/t/cubecart-6-6-0-released-the-biggest-update-in-years/62405refjvn.jp/en/jp/JVN78422311