CVE-2013-1465

9.8 criticalEPSS 7.1%

Critical (9.8) in cubecart cubecart. EPSS 7.1% chance of exploitation in the next 30 days.

The Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows remote attackers to unserialize arbitrary PHP objects via a crafted shipping parameter, as demonstrated by modifying the application configuration using the Config object.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 7.1% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWE: CWE-502
Published: 2013-02-08
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

cubecart:cubecart

References

http://archives.neohapsis.com/archives/bugtraq/2013-02/0032.html
http://forums.cubecart.com/?showtopic=47026
http://karmainsecurity.com/KIS-2013-02
http://osvdb.org/89923
http://packetstormsecurity.com/files/120094/CubeCart-5.2.0-PHP-Object-Injection.html

Check your stack JSON