PT-2025-38744 · Cubecart · Cubecart

Published 2025-09-22 · Updated 2025-09-22 · CVE-2025-59412

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.5.11

Description CubeCart, an ecommerce software solution, has an issue in the product reviews feature. User-supplied input is not properly sanitized before display. An attacker can submit HTML tags within the review description field. Upon administrator approval, this injected HTML is rendered on the product page for all visitors. This could potentially redirect users to malicious websites or display unwanted content.

Recommendations Update to version 6.5.11 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-59412

GHSA-QFRX-VVVP-H5M2

Affected Products

Cubecart

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59412.json · Exploit
• 🔥 https://github.com/cubecart/v6/security/advisories/GHSA-qfrx-vvvp-h5m2 · Exploit
• https://github.com/cubecart/v6/commit/7d4bf593304332fa1258d4f0b10dd7c9f6283a86 · Patch
• https://github.com/cubecart/v6/commit/1a0c0d8f6c9c141575eb5be07d04e7d49820005b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-59412 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59412 · Vendor Advisory
• https://twitter.com/CVEnew/status/1970167570809373127 · Twitter Post