Threat database

CVE-2026-35496 is a path traversal vulnerability in CubeCart versions prior to 6.6.0. It allows users with administrative privileges to access directories above the intended restricted directory. The vulnerability has a low severity score and does not affect confidentiality beyond limited information disclosure. There is no confirmed patch or official remediation guidance available at this time.

An SQL injection vulnerability exists in CubeCart versions prior to 6.6.0. This flaw allows an attacker to execute arbitrary SQL statements on the affected product, potentially impacting confidentiality, integrity, and availability. The vulnerability has a CVSS score of 6.3, indicating a medium severity level. There is no explicit vendor advisory or patch information provided in the data. No known exploits are reported in the wild at this time.

CVE-2026-21719 is an OS command injection vulnerability in CubeCart versions prior to 6.6.0. It allows a user with administrative privileges to execute arbitrary operating system commands. The vulnerability has a high severity rating with a CVSS score of 7.2. No official patch or remediation level has been confirmed yet. There are no known exploits in the wild at this time.