Devellion
Devellion Cubecart: vulnerabilidades y CVE
Devellion Cubecart tiene 21 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE21
Últimos 12 meses0
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2007-2862 | Alta (7.5) | 1.1% | — | 24 may 2007 | Multiple SQL injection vulnerabilities in CubeCart 3.0.16 might allow remote attackers to execute arbitrary SQL commands via an unspecified parameter to cart.inc.php and certain other files in an include directory,… |
| CVE-2007-2550 | Media (5) | 2.2% | — | 9 may 2007 | Multiple CRLF injection vulnerabilities in Devellion CubeCart 3.0.15 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a cookie name beginning with… |
| CVE-2006-5108 | Media (6.8) | 6.1% | — | 3 oct 2006 | Multiple cross-site scripting (XSS) vulnerabilities in Devellion CubeCart 2.0.x allow remote attackers to inject arbitrary web script or HTML via the order_id parameter in (1) admin/print_order.php and (2)… |
| CVE-2006-5107 | Alta (7.5) | 1.1% | — | 3 oct 2006 | Multiple SQL injection vulnerabilities in Devellion CubeCart 2.0.x allow remote attackers to execute arbitrary SQL commands via (1) the user_name parameter in admin/forgot_pass.php, (2) the order_id parameter in… |
| CVE-2006-5109 | Media (5) | 1.5% | — | 3 oct 2006 | Devellion CubeCart 2.0.x allows remote attackers to obtain sensitive information via a direct request for (1) link_navi.php or (2) spotlight.php, which reveals the path in various error messages. NOTE: the… |
| CVE-2006-4525 | Media (4.3) | 3.5% | — | 1 sept 2006 | Cross-site scripting (XSS) vulnerability in CubeCart 3.0.12 and earlier, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the links array. |
| CVE-2006-4526 | Alta (7.5) | 1.2% | — | 1 sept 2006 | SQL injection vulnerability in includes/content/viewCat.inc.php in CubeCart 3.0.12 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the searchArray[] parameter. |
| CVE-2006-4527 | Baja (2.6) | 1.6% | — | 1 sept 2006 | includes/content/gateway.inc.php in CubeCart 3.0.12 and earlier, when magic_quotes_gpc is disabled, uses an insufficiently restrictive regular expression to validate the gateway parameter, which allows remote attackers… |
| CVE-2006-4268 | Media (6.8) | 2.2% | — | 21 ago 2006 | Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) file, (2) x, and (3) y parameters in (a)… |
| CVE-2006-4267 | Alta (7.5) | 3.6% | — | 21 ago 2006 | Multiple SQL injection vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) oid parameter in modules/gateway/Protx/confirmed.php and the (2) x_invoice_num… |
| CVE-2006-0922 | Media (5) | 8.1% | — | 28 feb 2006 | CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, which results in an absolute path traversal vulnerability in FileUpload in… |
| CVE-2006-0245 | Media (4.3) | 1.4% | — | 18 ene 2006 | Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.7-pl1 allow remote attackers to inject arbitrary web script or HTML via the (3) redir, (4) productId, (5) docId, (6) act, and (7) catId parameters in… |
| CVE-2006-0064 | Alta (7.5) | 2.4% | — | 3 ene 2006 | PHP remote file include vulnerability in includes/orderSuccess.inc.php in CubeCart allows remote attackers to execute arbitrary PHP code via a URL in the glob[rootDir] parameter. |
| CVE-2005-3152 | Media (4.3) | 2.2% | — | 5 oct 2005 | Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.3 allow remote attackers to inject arbitrary web script or HTML via the redir parameter to (1) cart.php or (2) index.php, or (3) the searchStr… |
| CVE-2005-0442 | Media (5) | 8.3% | — | 2 may 2005 | Directory traversal vulnerability in index.php for CubeCart 2.0.4 allows remote attackers to read arbitrary files via the language parameter. |
| CVE-2005-0443 | Media (4.3) | 4.8% | — | 2 may 2005 | index.php in CubeCart 2.0.4 allows remote attackers to (1) obtain the full path for the web server or (2) conduct cross-site scripting (XSS) attacks via an invalid language parameter, which echoes the parameter in a PHP… |
| CVE-2005-0607 | Media (5) | 1.4% | — | 2 may 2005 | CubeCart 2.0.0 through 2.0.5 allows remote attackers to determine the full path of the server via direct calls without parameters to (1) information.php, (2) language.php, (3) list_docs.php, (4) popular_prod.php, (5)… |
| CVE-2005-0606 | Media (4.3) | 2.0% | — | 2 may 2005 | Cross-site scripting (XSS) vulnerability in settings.inc.php for CubeCart 2.0.0 through 2.0.5, as used in multiple PHP files, allows remote attackers to inject arbitrary HTML or web script via the (1) cat_id, (2)… |
| CVE-2005-1033 | Media (5) | 3.0% | — | 2 may 2005 | CubeCart 2.0.6 allows remote attackers to obtain sensitive information via an invalid (1) language parameter to index.php, (2) PHPSESSID parameter to index.php, (3) product parameter to tellafriend.php, (4) add… |
| CVE-2004-1579 | Media (5) | 1.2% | — | 31 dic 2004 | index.php in CubeCart 2.0.1 allows remote attackers to gain sensitive information via an HTTP request with an invalid cat_id parameter, which reveals the full path in a PHP error message. |
| CVE-2004-1580 | Alta (7.5) | 2.4% | — | 31 dic 2004 | SQL injection vulnerability in index.php in CubeCart 2.0.1 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter. |