Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13 results
Oct 14, 2026External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin".CVE-2026-103671 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 5.3
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained.
- Product
- AmazonPay V2 Plugin (4.0/4.1 series)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series.CVE-2024-41924 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpHigh 7.2
Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series. If this vulnerability is exploited, an attacker who obtained the administrative privilege may install an arbitrary PHP package. If the obsolete versions of PHP packages are installed, the product may be affected by some known vulnerabilities.
- Product
- EC-CUBE 4 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2023EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability CVE-2023-46845 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpHigh 7.2
EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper settings of the template engine Twig included in the product. As a result, arbitrary code may be executed on the server where the product is running by a user with an administrative privilege.
- Product
- EC-CUBE 4 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2023Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote autCVE-2023-25077 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote authenticated attacker to inject an arbitrary script.
- Product
- EC-CUBE 4 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2023Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 aCVE-2023-22838 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote authenticated attacker to inject an arbitrary script.
- Product
- EC-CUBE 4 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2023Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0), EC-CUBECVE-2023-22438 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0), EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p5), and EC-CUBE 2 series (EC-CUBE 2.11.0 to 2.11.5, EC-CUBE 2.12.0 to 2.12.6, EC-CUBE 2.13.0 to 2.13.5, and EC-CUBE 2.17.0 to 2.17.2) allows a remote authenticated attacker to inject an arbitrary script.
- Product
- EC-CUBE 4 series, EC-CUBE 3 series, and EC-CUBE 2 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2022Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated CVE-2022-40199 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpLow 2.7
Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an administrative privilege to obtain the product's directory structure information.
- Product
- EC-CUBE 3 series and EC-CUBE 4 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2022DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an adCVE-2022-38975 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 5.4
DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an administrative user of the product to visit a specially crafted page.
- Product
- EC-CUBE 4 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the CVE-2022-25355 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 5.3
EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE users.
- Product
- EC-CUBE 3 series and EC-CUBE 4 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0CVE-2022-21179 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0.4 (for EC-CUBE 3 series) allows a remote unauthenticated attacker to hijack the authentication of an administrator via a specially crafted page, and Mail Magazine Templates and/or transmitted history information may be deleted unintendedly.
- Product
- EC-CUBE plugin 'Mail Magazine Management Plugin'
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2021Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive informationCVE-2021-20778 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpHigh 7.5
Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified vectors.
- Product
- EC-CUBE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2021Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an CVE-2021-20751 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation.
- Product
- EC-CUBE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2021Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attCVE-2021-20750 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation.
- Product
- EC-CUBE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.