CVE-2026-54647NVD

Description

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled download_expire POST parameter into a raw UPDATE statement for CubeCart_downloads without numeric validation. An authenticated administrator can supply a comma-delimited value that changes the SET clause because HTML sanitization does not neutralize SQL syntax, allowing manipulation of database columns and potentially other data within the application's database privileges. This issue is fixed in version 6.7.5.

Severity Level

HIGH (7.2)

Published Date

17/09/2026

Last Modified

17/09/2026

Exploitation Status

????

EPSS Score

1.45% (percentile 72.1%)

CVSS Base Metrics

CVSS v3 (3.1)

HIGH 7.2

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-89 - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected & Patched Versions

Product	Affected Versions	Patched Version
cubecart v6	< 6.7.5	N/A

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

⚙️Custom EPSS — Filter noise, focus on risk.

💬Webhooks — Slack & Teams integration.

🚫Ad-Free — Uninterrupted experience.