CVE-2026-39358

CubeCart is an ecommerce software solution. Prior to 6.6.0, Authenticated Time-Based Blind SQL Injection vulnerabilities were identified in the sorting parameters (sort[price], sort_activity, sort_admin, and sort_customer) of the Products and Logs endpoints in CubeCart v6.x. This allows an attacker to execute arbitrary SQL commands, compromising the confidentiality and integrity of the database. This vulnerability is fixed in 6.6.0.

• CWE-89

• https://github.com/cubecart/v6/security/advisories/GHSA-8gj6-9fwc-h4gh
• https://github.com/cubecart/v6/security/advisories/GHSA-8gj6-9fwc-h4gh

Published

May 13, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39350Istio is an open platform to connect, manage, and secure mic…5.4
• CVE-2026-39351Frappe is a full-stack web application framework. Prior to 1…9.1
• CVE-2026-39352Frappe is a full-stack web application framework. Versions p…8.7
• CVE-2026-39354Scoold is a Q&A and a knowledge sharing platform for teams. …6.5
• CVE-2026-39355Genealogy is a family tree PHP application. Prior to 5.9.1, …8.8
• CVE-2026-39356Drizzle is a modern TypeScript ORM. Prior to 0.45.2 and 1.0.…7.5
• CVE-2026-39359Wazuh is a free and open source platform used for threat pre…7.5
• CVE-2026-3936Use after free in WebView in Google Chrome on Android prior …8.8
• CVE-2026-39360RustFS is a distributed object storage system built in Rust.…4.3
• CVE-2026-39361OpenObserve is a cloud-native observability platform. In 0.7…7.7
• CVE-2026-39362InvenTree is an Open Source Inventory Management System. Pri…7.1
• CVE-2026-39363Vite is a frontend tooling framework for JavaScript. From 6.…7.5