CVE-2026-54647

7.2 highEPSS 1.4%

High (7.2). EPSS 1.4% chance of exploitation in the next 30 days.

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled download_expire POST parameter into a raw UPDATE statement for CubeCart_downloads without numeric validation. An authenticated administrator can supply a comma-delimited value that changes the SET clause because HTML sanitization does not neutralize SQL syntax, allowing manipulation of database columns and potentially other data within the application's database privileges. This issue is fixed in version 6.7.5.

Severity

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-09-17
Modified: 2026-09-24
Record from: the NVD, synced 2026-10-19

References

https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php
https://github.com/cubecart/v6/commit/af7def4d279f7cefb23c1009a987737c16a105da
https://github.com/cubecart/v6/releases/tag/6.7.5
https://github.com/cubecart/v6/security/advisories/GHSA-hvmw-v8gc-4c29

Check your stack JSON