Total vulnerabilities in the database
Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) file, (2) x, and (3) y parameters in (a) admin/filemanager/preview.php; and the (4) email parameter in (b) admin/login.php.
| Software | From | Fixed in |
|---|---|---|
| devellion / cubecart | 3.0.3 | 3.0.3.x |
| devellion / cubecart | 3.0.7 | 3.0.7.x |
| devellion / cubecart | 3.0.6 | 3.0.6.x |
| devellion / cubecart | 3.0.11 | 3.0.11.x |
| devellion / cubecart | 3.0.4 | 3.0.4.x |
| devellion / cubecart | 3.0.7-pl1 | 3.0.7-pl1.x |