CVE-2025-59412

CubeCart is an ecommerce software solution. Prior to version 6.5.11, a vulnerability exists in the product reviews feature where user-supplied input is not properly sanitized before being displayed. An attacker can submit HTML tags inside the review description field. Once the administrator approves the review, the injected HTML is rendered on the product page for all visitors. This could be used to redirect users to malicious websites or to display unwanted content. This issue has been patched in version 6.5.11.

• CWE-79

• https://github.com/cubecart/v6/commit/1a0c0d8f6c9c141575eb5be07d04e7d49820005bPatch
• https://github.com/cubecart/v6/commit/7d4bf593304332fa1258d4f0b10dd7c9f6283a86Patch
• https://github.com/cubecart/v6/security/advisories/GHSA-qfrx-vvvp-h5m2Exploit, Vendor Advisory
• https://github.com/cubecart/v6/security/advisories/GHSA-qfrx-vvvp-h5m2Exploit, Vendor Advisory

Published

Sep 22, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59407The Flock Safety DetectionProcessing com.flocksafety.android…9.8
• CVE-2025-59408Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_…7.3
• CVE-2025-59409Flock Safety Falcon and Sparrow License Plate Readers OPM1.1…7.5
• CVE-2025-5941Netskope is notified about a potential gap in its agent (NS …2
• CVE-2025-59410Dragonfly is an open source P2P-based file distribution and …3.7
• CVE-2025-59411CubeCart is an ecommerce software solution. Prior to version…5.4
• CVE-2025-59413CubeCart is an ecommerce software solution. Prior to version…6.5
• CVE-2025-59414Nuxt is an open-source web development framework for Vue.js.…3.1
• CVE-2025-59415Frappe Learning is a learning system that helps users struct…5.4
• CVE-2025-59416The Scratch Channel is a news website. If the user makes a f…7.2
• CVE-2025-59417Lobe Chat is an open-source artificial intelligence chat fra…6.1
• CVE-2025-59418BunnyPad is a note taking software. Prior to version 11.0.27…5.5