Filtered by vendor Ec-cube
Subscriptions
Total
38 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-46845 | 1 Ec-cube | 1 Ec-cube | 2024-11-21 | 7.2 High |
| EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper settings of the template engine Twig included in the product. As a result, arbitrary code may be executed on the server where the product is running by a user with an administrative privilege. | ||||
| CVE-2023-40281 | 1 Ec-cube | 2 Ec-cube, Ec-cube 2 | 2024-11-21 | 4.8 Medium |
| EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the product. | ||||
| CVE-2023-25077 | 1 Ec-cube | 1 Ec-cube | 2024-11-21 | 5.4 Medium |
| Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote authenticated attacker to inject an arbitrary script. | ||||
| CVE-2023-22838 | 1 Ec-cube | 1 Ec-cube | 2024-11-21 | 5.4 Medium |
| Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote authenticated attacker to inject an arbitrary script. | ||||
| CVE-2023-22438 | 1 Ec-cube | 1 Ec-cube | 2024-11-21 | 5.4 Medium |
| Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0), EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p5), and EC-CUBE 2 series (EC-CUBE 2.11.0 to 2.11.5, EC-CUBE 2.12.0 to 2.12.6, EC-CUBE 2.13.0 to 2.13.5, and EC-CUBE 2.17.0 to 2.17.2) allows a remote authenticated attacker to inject an arbitrary script. | ||||
| CVE-2022-40199 | 1 Ec-cube | 1 Ec-cube | 2024-11-21 | 2.7 Low |
| Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an administrative privilege to obtain the product's directory structure information. | ||||
| CVE-2022-38975 | 1 Ec-cube | 1 Ec-cube | 2024-11-21 | 5.4 Medium |
| DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an administrative user of the product to visit a specially crafted page. | ||||
| CVE-2022-37346 | 1 Ec-cube | 1 Product Image Bulk Upload | 2024-11-21 | 9.8 Critical |
| EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files. If a user with an administrative privilege of EC-CUBE where the vulnerable plugin is installed is led to upload a specially crafted file, an arbitrary script may be executed on the system. | ||||
| CVE-2022-25355 | 1 Ec-cube | 1 Ec-cube | 2024-11-21 | 5.3 Medium |
| EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE users. | ||||
| CVE-2022-21179 | 1 Ec-cube | 1 E-mail Newsletter Management | 2024-11-21 | 4.3 Medium |
| Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0.4 (for EC-CUBE 3 series) allows a remote unauthenticated attacker to hijack the authentication of an administrator via a specially crafted page, and Mail Magazine Templates and/or transmitted history information may be deleted unintendedly. | ||||
| CVE-2021-20842 | 1 Ec-cube | 1 Ec-cube | 2024-11-21 | 6.5 Medium |
| Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page. | ||||
| CVE-2021-20841 | 1 Ec-cube | 1 Ec-cube | 2024-11-21 | 6.5 Medium |
| Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors. | ||||
| CVE-2021-20828 | 2 Activefusions, Ec-cube | 2 Order Status Batch Change, Ec-cube | 2024-11-21 | 6.1 Medium |
| Cross-site scripting vulnerability in Order Status Batch Change Plug-in (for EC-CUBE 3.0 series) all versions allows a remote attacker to inject an arbitrary script via unspecified vectors. | ||||
| CVE-2021-20825 | 2 Ec-cube, Shiro8 | 2 Ec-cube, List \(order Management\) Item Change | 2024-11-21 | 6.1 Medium |
| Cross-site scripting vulnerability in List (order management) item change plug-in (for EC-CUBE 3.0 series) Ver.1.1 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors. | ||||
| CVE-2021-20778 | 1 Ec-cube | 1 Ec-cube | 2024-11-21 | 7.5 High |
| Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified vectors. | ||||
| CVE-2021-20751 | 1 Ec-cube | 1 Ec-cube | 2024-11-21 | 6.1 Medium |
| Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation. | ||||
| CVE-2021-20750 | 1 Ec-cube | 1 Ec-cube | 2024-11-21 | 6.1 Medium |
| Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation. | ||||
| CVE-2021-20744 | 1 Ec-cube | 2 Business Form Output, Ec-cube | 2024-11-21 | 6.1 Medium |
| Cross-site scripting vulnerability in EC-CUBE Category contents plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.1 allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation. | ||||
| CVE-2021-20743 | 1 Ec-cube | 2 Ec-cube, Email Newsletters Management | 2024-11-21 | 6.1 Medium |
| Cross-site scripting vulnerability in EC-CUBE Email newsletters management plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.4 allows a remote attacker to inject an arbitrary script by leading a user to a specially crafted page and to perform a specific operation. | ||||
| CVE-2021-20742 | 1 Ec-cube | 2 Business Form Output, Ec-cube | 2024-11-21 | 6.1 Medium |
| Cross-site scripting vulnerability in EC-CUBE Business form output plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.1 allows a remote attacker to inject an arbitrary script via unspecified vector. | ||||