CVE-2012-0865

Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) r parameter to switch.php or (2) goto parameter to admin/login.php.

• CWE-20

• http://archives.neohapsis.com/archives/bugtraq/2012-02/0058.htmlExploit
• http://osvdb.org/79140
• http://osvdb.org/79141
• http://www.openwall.com/lists/oss-security/2012/02/12/4Exploit
• http://www.openwall.com/lists/oss-security/2012/02/13/5Exploit
• http://www.openwall.com/lists/oss-security/2012/02/18/1Exploit
• http://www.securityfocus.com/bid/51966Exploit
• http://www.securitytracker.com/id?1026711
• http://yehg.net/lab/pr0js/advisories/%5Bcubecart_3.0.20_3.0.x%5D_open_url_redirectionExploit
• http://archives.neohapsis.com/archives/bugtraq/2012-02/0058.htmlExploit
• http://osvdb.org/79140
• http://osvdb.org/79141
• http://www.openwall.com/lists/oss-security/2012/02/12/4Exploit
• http://www.openwall.com/lists/oss-security/2012/02/13/5Exploit
• http://www.openwall.com/lists/oss-security/2012/02/18/1Exploit
• http://www.securityfocus.com/bid/51966Exploit
• http://www.securitytracker.com/id?1026711
• http://yehg.net/lab/pr0js/advisories/%5Bcubecart_3.0.20_3.0.x%5D_open_url_redirectionExploit

Published

Feb 21, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-0859The render_line function in the vorbis codec (vorbis.c) in l…
• CVE-2012-0860Multiple untrusted search path vulnerabilities in Red Hat En…
• CVE-2012-0861The vds_installer in Red Hat Enterprise Virtualization Manag…
• CVE-2012-0862builtins.c in Xinetd before 2.3.15 does not check the servic…
• CVE-2012-0863Mumble 1.2.3 and earlier uses world-readable permissions for…
• CVE-2012-0864Integer overflow in the vfprintf function in stdio-common/vf…
• CVE-2012-0866CREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x befo…
• CVE-2012-0867PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.…
• CVE-2012-0868CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x …
• CVE-2012-0869Cross-site scripting (XSS) vulnerability in fup in Frams' Fa…
• CVE-2012-0870Heap-based buffer overflow in process.c in smbd in Samba 3.0…
• CVE-2012-0871The session_link_x11_socket function in login/logind-session…