CVE-2025-59411

CubeCart is an ecommerce software solution. Prior to version 6.5.11, the contact form’s Enquiry field accepts raw HTML and that HTML is included verbatim in the email sent to the store admin. By submitting HTML in the Enquiry, the admin receives an email containing that HTML. This indicates user input is not being escaped or sanitized before being output in email (and possibly when re-rendering the form), leading to Cross-Site Scripting / HTML injection risk in email clients or admin UI. This issue has been patched in version 6.5.11.

• CWE-79

• https://github.com/cubecart/v6/commit/299065bd4a8836782ce92f70988c730f130756dbPatch
• https://github.com/cubecart/v6/commit/48336c54532705873a8c4106208c2d596f128047Patch
• https://github.com/cubecart/v6/security/advisories/GHSA-5hg3-m3q3-v2p4Exploit, Vendor Advisory
• https://github.com/cubecart/v6/security/advisories/GHSA-5hg3-m3q3-v2p4Exploit, Vendor Advisory

Published

Sep 22, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59406The Flock Safety Pisco com.flocksafety.android.pisco applica…6.2
• CVE-2025-59407The Flock Safety DetectionProcessing com.flocksafety.android…9.8
• CVE-2025-59408Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_…7.3
• CVE-2025-59409Flock Safety Falcon and Sparrow License Plate Readers OPM1.1…7.5
• CVE-2025-5941Netskope is notified about a potential gap in its agent (NS …2
• CVE-2025-59410Dragonfly is an open source P2P-based file distribution and …3.7
• CVE-2025-59412CubeCart is an ecommerce software solution. Prior to version…5.4
• CVE-2025-59413CubeCart is an ecommerce software solution. Prior to version…6.5
• CVE-2025-59414Nuxt is an open-source web development framework for Vue.js.…3.1
• CVE-2025-59415Frappe Learning is a learning system that helps users struct…5.4
• CVE-2025-59416The Scratch Channel is a news website. If the user makes a f…7.2
• CVE-2025-59417Lobe Chat is an open-source artificial intelligence chat fra…6.1