PT-2025-38743 · Cubecart · Cubecart

Published 2025-09-22 · Updated 2025-09-22 · CVE-2025-59411

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.5.11

Description CubeCart is an ecommerce software solution. The contact form’s Enquiry field accepts raw HTML, which is included directly in the email sent to the store administrator. Submitting HTML through the Enquiry field results in the administrator receiving an email containing that HTML. This indicates a lack of proper escaping or sanitization of user input before outputting it in email, potentially leading to Cross-Site Scripting or HTML injection within email clients or the administrative user interface. The Enquiry field is the vulnerable parameter.

Recommendations Update to version 6.5.11 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-59411

GHSA-5HG3-M3Q3-V2P4

Affected Products

Cubecart

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59411.json · Exploit
• 🔥 https://github.com/cubecart/v6/security/advisories/GHSA-5hg3-m3q3-v2p4 · Exploit
• https://github.com/cubecart/v6/commit/299065bd4a8836782ce92f70988c730f130756db · Patch
• https://github.com/cubecart/v6/commit/48336c54532705873a8c4106208c2d596f128047 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-59411 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59411 · Vendor Advisory
• https://twitter.com/CVEnew/status/1970167571933450724 · Twitter Post