EUVD-2026-30164Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
CubeCart is an ecommerce software solution. Prior to 6.7.0, an unauthenticated Reflected XSS vulnerability exists in the CubeCart v6.x search feature. Due to a logic flaw in classes/catalogue.class.php, user input is reflected without sanitization only when a search returns exactly one product. This flaw bypasses current filters, allowing an attacker to execute malicious JavaScript in the victim's browser, leading to session hijacking, site defacement, or phishing. This vulnerability is fixed in 6.7.0.
AnalysisAI
Reflected XSS in CubeCart v6 (prior to 6.7.0) enables unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by delivering a crafted search URL that triggers a specific single-result code path in the search feature. The flaw exists in classes/catalogue.class.php where the searchCatalogue() method reflects the raw $_REQUEST['search']['keywords'] parameter in a notification message without sanitization - but only when the search returns exactly one product, bypassing all other input filters. A working exploit is publicly available on Exploit-DB (52588), though no public exploit identified at time of analysis places this in CISA KEV, and EPSS remains low at 0.03%.
Technical ContextAI
CubeCart is a PHP-based ecommerce platform (CPE: cpe:2.3:a:cubecart:v6:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Reflected XSS). Within classes/catalogue.class.php, the searchCatalogue() method passes $_REQUEST['search']['keywords'] directly into a sprintf() call used to construct a user-visible notification when exactly one product matches the query. This code path bypasses the sanitization applied in multi-result and zero-result branches. The fix, confirmed in commit b9d03e20b9d0f443f8ea55fd834e348438e2cc0c, wraps the keyword in htmlspecialchars((string)$_REQUEST['search']['keywords'], ENT_QUOTES, 'UTF-8') at two locations within the method, covering both affected conditional branches. The ENT_QUOTES flag ensures both single and double quotes are encoded, preventing attribute-context escapes.
RemediationAI
Upgrade to CubeCart 6.7.0, which contains the vendor-released patch confirmed in commit b9d03e20b9d0f443f8ea55fd834e348438e2cc0c and the GitHub security advisory at https://github.com/cubecart/v6/security/advisories/GHSA-gvcp-wpvp-c6f7. If immediate upgrade is not feasible, deploy a WAF rule to sanitize or block XSS payloads (e.g., angle brackets, javascript: schemes, event handler strings) in the search[keywords] POST/GET parameter - note this may reject legitimate searches containing HTML-like characters and requires tuning. An additional compensating control is to configure Content-Security-Policy headers to restrict inline script execution, which would neutralize injected payloads even if the XSS fires, though CSP implementation in CubeCart v6 would need to be verified for template compatibility.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today