https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 09:39:15 +0000 https://db.gcve.eu/vuln/cve-2026-54647 <p><strong>Affected:</strong> cubecart v6</p> <p>CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled download_expire POST parameter into a raw UPDATE statement for CubeCart_downloads without numeric validation. An authenticated administrator can supply a comma-delimited value that changes the SET clause because HTML sanitization does not neutralize SQL syntax, allowing manipulation of database columns and potentially other data within the application&#39;s database privileges. This issue is fixed in version 6.7.5.</p> <p><strong>Affected:</strong> cubecart v6</p> <p>CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled download_expire POST parameter into a raw UPDATE statement for CubeCart_downloads without numeric validation. An authenticated administrator can supply a comma-delimited value that changes the SET clause because HTML sanitization does not neutralize SQL syntax, allowing manipulation of database columns and potentially other data within the application&#39;s database privileges. This issue is fixed in version 6.7.5.</p> https://db.gcve.eu/vuln/cve-2026-54647