Skip to main content

Cubecart EUVD-2026-23368

| CVE-2026-34018 MEDIUM
SQL Injection (CWE-89)
2026-04-17 jpcert
SQLi Cubecart
5.1
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

5
CVSS changed
Apr 17, 2026 - 06:22 NVD
6.3 (MEDIUM) 5.1 (MEDIUM)
Analysis Generated
Apr 17, 2026 - 05:36 vuln.today
EUVD ID Assigned
Apr 17, 2026 - 05:30 euvd
EUVD-2026-23368
Analysis Generated
Apr 17, 2026 - 05:30 vuln.today
CVE Published
Apr 17, 2026 - 04:33 nvd
MEDIUM 5.1

DescriptionCVE.org

An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the product.

AnalysisAI

SQL injection in CubeCart prior to 6.6.0 allows remote unauthenticated attackers to execute arbitrary SQL statements through a request requiring user interaction, affecting the e-commerce platform's database integrity and confidentiality. The vulnerability has a CVSS score of 6.3 with network-accessible attack vector and low complexity, though exploitation requires user engagement (UI:R) which moderates real-world risk. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Attacker identifies CubeCart instance
Delivery
Crafts SQL injection payload in vulnerable parameter
Exploit
Sends malicious link to victim via email or website
Execution
Victim clicks link or submits form
Persist
SQL payload executes in database context
Impact
Attacker exfiltrates customer data or modifies database records
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a CubeCart instance running version 6.5.x or earlier with the vulnerable SQL query handling code present. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment CVSS score of 6.3 (medium) with AV:N/AC:L initially appears concerning for an SQLi flaw, but the UI:R (user interaction required) flag significantly limits exploitation probability in comparison to unauthenticated network SQL injection without user clicks. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker crafts a malicious URL or HTML form that, when clicked or submitted by a CubeCart administrator or customer, injects SQL syntax into a vulnerable parameter (e.g., a product search field, filter, or custom form). The injected SQL executes in the context of the CubeCart database connection, allowing the attacker to extract customer tables, modify product prices, or insert administrative accounts. …
Remediation Upgrade CubeCart to version 6.6.0 or later immediately; this version addresses the SQL injection vulnerability per vendor announcement at https://community.cubecart.com/t/cubecart-6-6-0-released-the-biggest-update-in-years/62405. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

EUVD-2026-23368 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy