PT-2026-40803 · Cubecart · Cubecart

Published 2026-05-13 · Updated 2026-05-13 · CVE-2026-39358

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.6.0

Description Authenticated Time-Based Blind SQL Injection—a technique that allows an attacker to infer data by observing the time the server takes to respond to specific queries—exists in the Products and Logs endpoints. The issue resides in the sorting parameters sort[price], sort activity, sort admin, and sort customer, enabling an attacker to execute arbitrary SQL commands and compromise the confidentiality and integrity of the database.

Recommendations Update to version 6.6.0. As a temporary workaround, restrict access to the sorting parameters sort[price], sort activity, sort admin, and sort customer in the Products and Logs endpoints.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-39358

Affected Products

Cubecart

References · 3

• 🔥 https://github.com/cubecart/v6/security/advisories/GHSA-8gj6-9fwc-h4gh · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-39358 · Security Note
• https://twitter.com/CVEnew/status/2054709218524250484 · Twitter Post