Vendor
high
threat
SQL Injection in CubeCart 6.7.4
2 rules 3 TTPsAn authenticated SQL injection vulnerability in CubeCart 6.7.4 allows administrative users to execute arbitrary SQL commands due to improper sanitization of the download_expire parameter.
exploited
CubeCart +1
webapps
sqli
cube-cart
xss
injection
cve-2026-54644
2r
3t
high
advisory
CubeCart < 6.7.0 Unauthenticated Reflected Cross-Site Scripting (XSS)
2 rules 1 TTP 1 CVECubeCart versions before 6.7.0 are vulnerable to reflected cross-site scripting (XSS), allowing an unauthenticated attacker to inject malicious JavaScript payloads via the search functionality, which will be executed in the context of the victim's browser.
CubeCart < 6.7.0
xss
reflected-xss
web-application
cubecart
2r
1t
1c