Browse CVEs

MEDIUM 6.5 CVE-2026-30777 EC-CUBE provided by EC-CUBE CO.,LTD. contains a multi-factor authentication (MFA) bypass vulnerability. An attacker who has obtained a valid administ… Ec Cube 4.1.2 / 4.2.3+ Fix from $1,6002026-03-05 HIGH 7.2 CVE-2023-46845 EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vul… Ec Cube 4.2.3+ Fix from $1,9502023-11-07 MEDIUM 5.4 CVE-2023-22438 Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.… Ec Cube after 4.1.2 Fix from $1,6002023-03-06 MEDIUM 5.4 CVE-2023-22838 Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-C… Ec Cube after 4.1.2 Fix from $1,6002023-03-06 MEDIUM 5.4 CVE-2023-25077 Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a… Ec Cube after 4.1.2 Fix from $1,6002023-03-06 MEDIUM 5.4 CVE-2022-38975 DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by h… Ec Cube after 4.1.2 Fix from $1,6002022-09-27 CRITICAL 9.8 CVE-2022-37346 EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploitin… Product Image Bulk Upload Patch available Fix from $2,3002022-09-27 MEDIUM 5.3 CVE-2022-25355 EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to … Ec Cube 3.0.18+ Fix from $1,6002022-02-24 MEDIUM 6.5 CVE-2021-20841 Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction… Ec Cube after 2.17.1 Fix from $1,6002021-11-24 MEDIUM 6.5 CVE-2021-20842 Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Adminis… Ec Cube after 2.17.1 Fix from $1,6002021-11-24 HIGH 7.5 CVE-2021-20778 Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive … Ec Cube Patch available Fix from $1,9502021-07-01 MEDIUM 6.1 CVE-2021-20750 Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a… Ec Cube 3.0.18 / 4.0.5+ Fix from $1,6002021-06-28 MEDIUM 6.1 CVE-2021-20751 Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by … Ec Cube 4.0.5+ Fix from $1,6002021-06-28 MEDIUM 6.1 CVE-2021-20735 Cross-site scripting vulnerability in ETUNA EC-CUBE plugins (Delivery slip number plugin (3.0 series) 1.0.10 and earlier, Delivery slip number csv bu… Delivery Slip Number after 1.0.10 Fix from $1,6002021-06-22 MEDIUM 6.1 CVE-2021-20742 Cross-site scripting vulnerability in EC-CUBE Business form output plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.1 allows a remote at… Business Form Output 1.0.1+ Fix from $1,6002021-06-22 MEDIUM 6.1 CVE-2021-20743 Cross-site scripting vulnerability in EC-CUBE Email newsletters management plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.4 allows a r… Email Newsletters Management 1.0.4+ Fix from $1,6002021-06-22 MEDIUM 6.1 CVE-2021-20744 Cross-site scripting vulnerability in EC-CUBE Category contents plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.1 allows a remote attac… Business Form Output 1.0.1+ Fix from $1,6002021-06-22 MEDIUM 6.1 CVE-2021-20717 Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input fiel… Ec Cube 4.0.5+ Fix from $1,6002021-05-10 HIGH 7.5 CVE-2020-5680 Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) conditio… Ec Cube after 3.0.18 Fix from $1,9502020-12-03 MEDIUM 6.1 CVE-2020-5679 Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a spe… Ec Cube after 3.0.18 Fix from $1,6002020-12-03 HIGH 8.1 CVE-2020-5590 Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/o… Ec Cube after 4.0.3 Fix from $1,9502020-06-19 MEDIUM 6.1 CVE-2019-6003 Cross-site scripting vulnerability in EC-CUBE plugin 'Amazon Pay Plugin 2.12,2.13' version 2.4.2 and earlier allows remote attackers to inject arbitr… Amazon Pay after 2.4.2 Fix from $1,6002019-09-12 MEDIUM 6.1 CVE-2018-16191 Open redirect vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3.0.4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-C… Ec Cube after 3.0.16 Fix from $1,6002019-01-09 HIGH 7.2 CVE-2018-0658 Input validation issue in EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG … Ec Cube Payment Module after 3.5.23 Fix from $1,9502018-09-07 CRITICAL 9.8 CVE-2016-4837 SQL injection vulnerability in the Seed Coupon plugin before 1.6 for EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecifie… Discount Coupon after 1.5 Fix from $2,3002016-08-01 MEDIUM 5.0 CVE-2009-4236 The process function in data/class/pages/admin/customer/LC_Page_Admin_Customer_SearchCustomer.php in EC-CUBE Ver2 2.4.0 RC1 through 2.4.1, and Commun… Ec Cube Ver2 Patch available Fix from $1,6002009-12-08 HIGH 7.5 CVE-2008-4991 SQL injection vulnerability in LOCKON CO.,LTD. EC-CUBE 2.3.0 and earlier, 1.4.7 and earlier, and 1.5.0-beta2 and earlier; and Community Edition 1.3.5… Ec Cube after 2.3.0 Fix from $1,9502008-11-06 HIGH 7.5 CVE-2008-4534 SQL injection vulnerability in EC-CUBE Ver2 2.1.2a and earlier, and Ver2 RC 2.3.0-rc1 and earlier, allows remote attackers to execute arbitrary SQL c… Ec Cube after 2.3.0 Fix from $1,9502008-10-10