Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
72 results · page 1 of 2
Oct 14, 2026External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin".CVE-2026-103671 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 5.3
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained.
- Product
- AmazonPay V2 Plugin (4.0/4.1 series)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026EC-CUBE provided by EC-CUBE CO.,LTD.CVE-2026-30777 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 6.9
EC-CUBE provided by EC-CUBE CO.,LTD. contains a multi-factor authentication (MFA) bypass vulnerability. An attacker who has obtained a valid administrator ID and password may be able to bypass two-factor authentication and gain unauthorized access to the administrative page.
- Product
- EC-CUBE 4.1 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series.CVE-2024-41924 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpHigh 7.2
Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series. If this vulnerability is exploited, an attacker who obtained the administrative privilege may install an arbitrary PHP package. If the obsolete versions of PHP packages are installed, the product may be affected by some known vulnerabilities.
- Product
- EC-CUBE 4 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024Stored cross-site scripting vulnerability exists in EC-CUBE Web API Plugin.CVE-2024-41141 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 6.1
Stored cross-site scripting vulnerability exists in EC-CUBE Web API Plugin. When there are multiple users using OAuth Management feature and one of them inputs some crafted value on the OAuth Management page, an arbitrary script may be executed on the web browser of the other user who accessed the management page.
- Product
- EC-CUBE Web API Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2023EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability CVE-2023-46845 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpHigh 7.2
EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper settings of the template engine Twig included in the product. As a result, arbitrary code may be executed on the server where the product is running by a user with an administrative privilege.
- Product
- EC-CUBE 4 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2023EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page.CVE-2023-40281 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 4.8
EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the product.
- Product
- EC-CUBE 2 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Authentication bypass vulnerability in NEXT ENGINE Integration Plugin (for EC-CUBE 2.0 series) all versions allows a remote unauthenticated attacker to alter thCVE-2023-27919 · Other software · NE Inc. · reported by vultures@jpcert.or.jpMedium 5.3
Authentication bypass vulnerability in NEXT ENGINE Integration Plugin (for EC-CUBE 2.0 series) all versions allows a remote unauthenticated attacker to alter the information stored in the system.
- Product
- NEXT ENGINE Integration Plugin (for EC-CUBE 2.0 series)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpmain.next-engine.com
Mar 5, 2023Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote autCVE-2023-25077 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote authenticated attacker to inject an arbitrary script.
- Product
- EC-CUBE 4 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2023Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 aCVE-2023-22838 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote authenticated attacker to inject an arbitrary script.
- Product
- EC-CUBE 4 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2023Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0), EC-CUBECVE-2023-22438 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0), EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p5), and EC-CUBE 2 series (EC-CUBE 2.11.0 to 2.11.5, EC-CUBE 2.12.0 to 2.12.6, EC-CUBE 2.13.0 to 2.13.5, and EC-CUBE 2.17.0 to 2.17.2) allows a remote authenticated attacker to inject an arbitrary script.
- Product
- EC-CUBE 4 series, EC-CUBE 3 series, and EC-CUBE 2 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2022Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated CVE-2022-40199 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpLow 2.7
Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an administrative privilege to obtain the product's directory structure information.
- Product
- EC-CUBE 3 series and EC-CUBE 4 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2022DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an adCVE-2022-38975 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 5.4
DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an administrative user of the product to visit a specially crafted page.
- Product
- EC-CUBE 4 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2022EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files.CVE-2022-37346 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpCritical 9.8
EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files. If a user with an administrative privilege of EC-CUBE where the vulnerable plugin is installed is led to upload a specially crafted file, an arbitrary script may be executed on the system.
- Product
- Product Image Bulk Upload Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2022Cross-site request forgery (CSRF) vulnerability in Easy Blog for EC-CUBE4 Ver.1.0.1 and earlier allows a remote unauthenticated attacker to hijack the authenticCVE-2022-27174 · Other software · COREMOBILE Co. Ltd. · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site request forgery (CSRF) vulnerability in Easy Blog for EC-CUBE4 Ver.1.0.1 and earlier allows a remote unauthenticated attacker to hijack the authentication of the administrator and delete a blog article or a category via a specially crafted page.
- Product
- Easy Blog for EC-CUBE4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the CVE-2022-25355 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 5.3
EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE users.
- Product
- EC-CUBE 3 series and EC-CUBE 4 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0CVE-2022-21179 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0.4 (for EC-CUBE 3 series) allows a remote unauthenticated attacker to hijack the authentication of an administrator via a specially crafted page, and Mail Magazine Templates and/or transmitted history information may be deleted unintendedly.
- Product
- EC-CUBE plugin 'Mail Magazine Management Plugin'
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2021Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and CVE-2021-20842 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 6.5
Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page.
- Product
- EC-CUBE 2 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2021Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to altCVE-2021-20841 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 6.5
Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors.
- Product
- EC-CUBE 2 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2021Cross-site scripting vulnerability in Order Status Batch Change Plug-in (for EC-CUBE 3.0 series) all versions allows a remote attacker to inject an arbitrary scCVE-2021-20828 · Other software · ActiveFusions Co., Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Order Status Batch Change Plug-in (for EC-CUBE 3.0 series) all versions allows a remote attacker to inject an arbitrary script via unspecified vectors.
- Product
- Order Status Batch Change Plug-in (for EC-CUBE 3.0 series)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpactivefusions.com
Sep 16, 2021Cross-site scripting vulnerability in List (order management) item change plug-in (for EC-CUBE 3.0 series) Ver.1.1 and earlier allows a remote attacker to injecCVE-2021-20825 · Other software · shiro8 Co., Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in List (order management) item change plug-in (for EC-CUBE 3.0 series) Ver.1.1 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors.
- Product
- List (order management) item change plug-in (for EC-CUBE 3.0 series)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2021Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive informationCVE-2021-20778 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpHigh 7.5
Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified vectors.
- Product
- EC-CUBE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2021Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an CVE-2021-20751 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation.
- Product
- EC-CUBE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2021Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attCVE-2021-20750 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation.
- Product
- EC-CUBE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2021Cross-site scripting vulnerability in EC-CUBE Category contents plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.1 allows a remote attacker to injeCVE-2021-20744 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in EC-CUBE Category contents plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.1 allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation.
- Product
- EC-CUBE Category contents plugin (for EC-CUBE 3.0 series)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2021Cross-site scripting vulnerability in EC-CUBE Email newsletters management plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.4 allows a remote attacCVE-2021-20743 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in EC-CUBE Email newsletters management plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.4 allows a remote attacker to inject an arbitrary script by leading a user to a specially crafted page and to perform a specific operation.
- Product
- EC-CUBE Email newsletters management plugin (for EC-CUBE 3.0 series)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2021Cross-site scripting vulnerability in EC-CUBE Business form output plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.1 allows a remote attacker to iCVE-2021-20742 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in EC-CUBE Business form output plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.1 allows a remote attacker to inject an arbitrary script via unspecified vector.
- Product
- EC-CUBE Business form output plugin (for EC-CUBE 3.0 series)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2021Cross-site scripting vulnerability in ETUNA EC-CUBE plugins (Delivery slip number plugin (3.0 series) 1.0.10 and earlier, Delivery slip number csv bulk registraCVE-2021-20735 · Other software · ETUNA · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in ETUNA EC-CUBE plugins (Delivery slip number plugin (3.0 series) 1.0.10 and earlier, Delivery slip number csv bulk registration plugin (3.0 series) 1.0.8 and earlier, and Delivery slip number mail plugin (3.0 series) 1.0.8 and earlier) allows remote attackers to inject an arbitrary script by executing a specific operation on the management page of EC-CUBE.
- Product
- ETUNA EC-CUBE plugins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2021Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the ECCVE-2021-20717 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser.
- Product
- EC-CUBE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2020Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) condition via unspeCVE-2020-5680 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpHigh 7.5
Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vector.
- Product
- EC-CUBE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2020Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks.CVE-2020-5679 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 6.1
Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted.
- Product
- EC-CUBE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2020Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directoriCVE-2020-5590 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpHigh 8.1
Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors.
- Product
- EC-CUBE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2019Cross-site scripting vulnerability in EC-CUBE plugin 'Amazon Pay Plugin 2.12,2.13' version 2.4.2 and earlier allows remote attackers to inject arbitrary web scrCVE-2019-6003 · Other software · LTD." · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in EC-CUBE plugin 'Amazon Pay Plugin 2.12,2.13' version 2.4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- EC-CUBE plugin 'Amazon Pay Plugin 2.12,2.13'
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Open redirect vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3.0.4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0.7, CVE-2018-16191 · Other software · LOCKON CO.,LTD. · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3.0.4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0.7, EC-CUBE 3.0.8, EC-CUBE 3.0.9, EC-CUBE 3.0.10, EC-CUBE 3.0.11, EC-CUBE 3.0.12, EC-CUBE 3.0.12-p1, EC-CUBE 3.0.13, EC-CUBE 3.0.14, EC-CUBE 3.0.15, EC-CUBE 3.0.16) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
- Product
- EC-CUBE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comjvn.jp
Sep 7, 2018Input validation issue in EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment ModCVE-2018-0658 · Other software · GMO Payment Gateway, Inc. · reported by vultures@jpcert.or.jpHigh 7.2
Input validation issue in EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier allows an attacker with administrative rights to execute arbitrary PHP code on the server via unspecified vectors.
- Product
- EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2018Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) verCVE-2018-0657 · Other software · GMO Payment Gateway, Inc. · reported by vultures@jpcert.or.jpMedium 4.8
Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier, and GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier) allow an attacker with administrator rights to inject arbitrary web script or HTML via unspecified vectors.
- Product
- EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2018Session fixation vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3..4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0.7CVE-2018-0564 · Other software · LOCKON CO.,LTD. · reported by vultures@jpcert.or.jpHigh 8.1
Session fixation vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3..4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0.7, EC-CUBE 3.0.8, EC-CUBE 3.0.9, EC-CUBE 3.0.10, EC-CUBE 3.0.11, EC-CUBE 3.0.12, EC-CUBE 3.0.12-p1, EC-CUBE 3.0.13, EC-CUBE 3.0.14, EC-CUBE 3.0.15) allows remote attackers to perform arbitrary operations via unspecified vectors.
- Product
- EC-CUBE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2016SQL injection vulnerability in the Seed Coupon plugin before 1.6 for EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors.CVE-2016-4837 · Other software · Ec-cube · reported by vultures@jpcert.or.jpCritical 9.8
SQL injection vulnerability in the Seed Coupon plugin before 1.6 for EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Discount Coupon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2016Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to hijack the authentication of administrators.CVE-2016-1201 · Other software · Lockon · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to hijack the authentication of administrators.
- Product
- Ec-cube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2016The management screen in LOCKON EC-CUBE 3.0.7 through 3.0.9 allows remote authenticated users to bypass intended access restrictions via unspecified vectors, a CVE-2016-1200 · Other software · Lockon · reported by vultures@jpcert.or.jpMedium 6.3
The management screen in LOCKON EC-CUBE 3.0.7 through 3.0.9 allows remote authenticated users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2016-1199.
- Product
- Ec-cube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2016The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrictions via unspecifiedCVE-2016-1199 · Other software · Lockon · reported by vultures@jpcert.or.jpMedium 5.3
The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrictions via unspecified vectors, a different vulnerability than CVE-2016-1200.
- Product
- Ec-cube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2016Cross-site scripting (XSS) vulnerability in the Cyber-Will Social-button Premium plugin before 1.1 for EC-CUBE 2.13.x allows remote attackers to inject arbitrarCVE-2016-1180 · Other software · Cyber-will · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting (XSS) vulnerability in the Cyber-Will Social-button Premium plugin before 1.1 for EC-CUBE 2.13.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Social-button Premium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2016SQL injection vulnerability in the Help plug-in 1.3.5 and earlier in Cuore EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vecCVE-2016-1154 · Other software · Cuore · reported by vultures@jpcert.or.jpCritical 9.1
SQL injection vulnerability in the Help plug-in 1.3.5 and earlier in Cuore EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Ec-cube Help Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2015SQL injection vulnerability in the BOKUBLOCK (1) BbAdminViewsControl213 plugin before 1.1 and (2) BbAdminViewsControl plugin before 2.1 for EC-CUBE allows remotCVE-2015-7784 · Other software · Bokublock · reported by vultures@jpcert.or.jpMedium 4.3
SQL injection vulnerability in the BOKUBLOCK (1) BbAdminViewsControl213 plugin before 1.1 and (2) BbAdminViewsControl plugin before 2.1 for EC-CUBE allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
- Product
- Bbadminviewscontrol
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2015Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.3 allows remote attackers to hijack the authentication of arbitrary users CVE-2015-5665 · Other software · Lockon · reported by vultures@jpcert.or.jpMedium 5.1
Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.3 allows remote attackers to hijack the authentication of arbitrary users for requests that write to PHP scripts, related to the doValidToken function.
- Product
- Ec-cube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2014Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015.CVE-2014-0808 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpCritical 9.1
Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users' information by sending a crafted HTTP request.
- Product
- EC-CUBE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2014data/class/pages/shopping/LC_Page_Shopping_Deliv.php in LOCKON EC-CUBE 2.4.4 and earlier, and 2.11.0 through 2.12.2, allows remote attackers to modify data via CVE-2014-0807 · Other software · Lockon · reported by vultures@jpcert.or.jpMedium 6.4
data/class/pages/shopping/LC_Page_Shopping_Deliv.php in LOCKON EC-CUBE 2.4.4 and earlier, and 2.11.0 through 2.12.2, allows remote attackers to modify data via unspecified vectors.
- Product
- Ec-cube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2013Multiple cross-site scripting (XSS) vulnerabilities in shopping/payment.tpl components in LOCKON EC-CUBE 2.11.0 through 2.13.0 allow remote attackers to inject CVE-2013-5996 · Other software · Lockon · reported by vultures@jpcert.or.jpMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in shopping/payment.tpl components in LOCKON EC-CUBE 2.11.0 through 2.13.0 allow remote attackers to inject arbitrary web script or HTML via crafted values.
- Product
- Ec-cube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2013data/class/helper/SC_Helper_Address.php in the front-features implementation in LOCKON EC-CUBE 2.12.3 through 2.13.0 allows remote authenticated users to obtainCVE-2013-5995 · Other software · Lockon · reported by vultures@jpcert.or.jpMedium 5.5
data/class/helper/SC_Helper_Address.php in the front-features implementation in LOCKON EC-CUBE 2.12.3 through 2.13.0 allows remote authenticated users to obtain sensitive information via unspecified vectors related to addresses.
- Product
- Ec-cube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2013data/class/pages/mypage/LC_Page_Mypage_DeliveryAddr.php in LOCKON EC-CUBE 2.11.2 through 2.13.0 allows remote attackers to obtain sensitive information via a diCVE-2013-5994 · Other software · Lockon · reported by vultures@jpcert.or.jpMedium 5
data/class/pages/mypage/LC_Page_Mypage_DeliveryAddr.php in LOCKON EC-CUBE 2.11.2 through 2.13.0 allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.
- Product
- Ec-cube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2013Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.0 allows remote attackers to hijack the authentication of arbitrary users CVE-2013-5993 · Other software · Lockon · reported by vultures@jpcert.or.jpMedium 6.8
Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.0 allows remote attackers to hijack the authentication of arbitrary users via unspecified vectors related to refusals.
- Product
- Ec-cube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.