CVE-2026-54644 (GCVE-0-2026-54644)
Vulnerability from cvelistv5
Published
2026-09-17 22:03
Modified
2026-09-18 20:02
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip_tags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data that reaches a GUI message can carry a javascript: URI or event handler through the filter, and viewing or interacting with the rendered anchor executes JavaScript in the victim's browser session, enabling session exposure or unauthorized application actions. This issue is fixed in version 6.7.5.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54644",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T20:02:00.554438Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:02:30.778Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/cubecart/v6/security/advisories/GHSA-v55x-fh73-29vq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "v6",
"vendor": "cubecart",
"versions": [
{
"status": "affected",
"version": "\u003c 6.7.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip_tags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data that reaches a GUI message can carry a javascript: URI or event handler through the filter, and viewing or interacting with the rendered anchor executes JavaScript in the victim\u0027s browser session, enabling session exposure or unauthorized application actions. This issue is fixed in version 6.7.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T22:03:41.767Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/cubecart/v6/security/advisories/GHSA-v55x-fh73-29vq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/cubecart/v6/security/advisories/GHSA-v55x-fh73-29vq"
},
{
"name": "https://github.com/cubecart/v6/commit/7c4c0081fd346578a95738f480ef647116ee1c82",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cubecart/v6/commit/7c4c0081fd346578a95738f480ef647116ee1c82"
},
{
"name": "https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php"
},
{
"name": "https://github.com/cubecart/v6/releases/tag/6.7.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cubecart/v6/releases/tag/6.7.5"
}
],
"source": {
"advisory": "GHSA-v55x-fh73-29vq",
"discovery": "UNKNOWN"
},
"title": "CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54644",
"datePublished": "2026-09-17T22:03:41.767Z",
"dateReserved": "2026-06-15T20:16:46.198Z",
"dateUpdated": "2026-09-18T20:02:30.778Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-54644\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-18T20:02:00.554438Z\"}}}], \"references\": [{\"url\": \"https://github.com/cubecart/v6/security/advisories/GHSA-v55x-fh73-29vq\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-18T20:02:23.394Z\"}}], \"cna\": {\"title\": \"CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System\", \"source\": {\"advisory\": \"GHSA-v55x-fh73-29vq\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"cubecart\", \"product\": \"v6\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 6.7.5\"}]}], \"references\": [{\"url\": \"https://github.com/cubecart/v6/security/advisories/GHSA-v55x-fh73-29vq\", \"name\": \"https://github.com/cubecart/v6/security/advisories/GHSA-v55x-fh73-29vq\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/cubecart/v6/commit/7c4c0081fd346578a95738f480ef647116ee1c82\", \"name\": \"https://github.com/cubecart/v6/commit/7c4c0081fd346578a95738f480ef647116ee1c82\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php\", \"name\": \"https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/cubecart/v6/releases/tag/6.7.5\", \"name\": \"https://github.com/cubecart/v6/releases/tag/6.7.5\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip_tags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data that reaches a GUI message can carry a javascript: URI or event handler through the filter, and viewing or interacting with the rendered anchor executes JavaScript in the victim\u0027s browser session, enabling session exposure or unauthorized application actions. This issue is fixed in version 6.7.5.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-17T22:03:41.767Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-54644\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-18T20:02:30.778Z\", \"dateReserved\": \"2026-06-15T20:16:46.198Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-09-17T22:03:41.767Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…