CVE-2026-39358

7.2 Élevée

Publiée le 13/05/2026 à 23:16 · Modifiée le 17/06/2026 à 12:41 · Analyse NVD reportée · Source : security-advisories@github.com

Description

CubeCart is an ecommerce software solution. Prior to 6.6.0, Authenticated Time-Based Blind SQL Injection vulnerabilities were identified in the sorting parameters (sort[price], sort_activity, sort_admin, and sort_customer) of the Products and Logs endpoints in CubeCart v6.x. This allows an attacker to execute arbitrary SQL commands, compromising the confidentiality and integrity of the database. This vulnerability is fixed in 6.6.0.

Traduire en français

Produits concernés

cubecart v6

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.2 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-89

Références

https://github.com/cubecart/v6/security/advisories/GHSA-8gj6-9fwc-h4gh
https://github.com/cubecart/v6/security/advisories/GHSA-8gj6-9fwc-h4gh

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories