SQL Injection Vulnerability in CubeCart Product by CubeCart Ltd.
CVE-2026-34018

5.1MEDIUM

Key Information:

Vendor

Cubecart Limited

Status
Cubecart
Vendor
CVE Published:
17 April 2026

What is CVE-2026-34018?

An SQL injection vulnerability has been identified in CubeCart versions prior to 6.6.0, enabling attackers to run arbitrary SQL queries. This flaw could lead to unauthorized data access or manipulation, severely compromising the security and integrity of the affected systems.

Affected Version(s)

CubeCart prior to 6.6.0

References

https://community.cubecart.com/t/cubecart-6-6-0-released-...
https://jvn.jp/en/jp/JVN78422311/

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

CVSS V3.0

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.