CVE-2026-54646

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated administrator can terminate the quoted identifier with a closing backtick and introduce attacker-controlled structural SQL, potentially compromising database confidentiality, integrity, and availability within the application's database privileges. This issue is fixed in version 6.7.5.

• CWE-89

• https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php
• https://github.com/cubecart/v6/commit/fc08d55628191969f2345d06d862df316f7d44d3
• https://github.com/cubecart/v6/releases/tag/6.7.5
• https://github.com/cubecart/v6/security/advisories/GHSA-qcx6-cg43-ffmx

Published

Sep 17, 2026

Last Modified

Sep 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54639Style Dictionary, a build system for creating cross-platform…8.8
• CVE-2026-5464The ExactMetrics – Google Analytics Dashboard for WordPress …7.2
• CVE-2026-54642CubeCart is an ecommerce software solution. Prior to 6.7.5, …5.3
• CVE-2026-54643CubeCart is an ecommerce software solution. Prior to 6.7.5, …5.4
• CVE-2026-54644CubeCart is an ecommerce software solution. Prior to 6.7.5, …6.1
• CVE-2026-54645CubeCart is an ecommerce software solution. Prior to 6.7.5, …4.8
• CVE-2026-54647CubeCart is an ecommerce software solution. Prior to 6.7.5, …7.2
• CVE-2026-54648CubeCart is an ecommerce software solution. Prior to 6.7.5, …6.5
• CVE-2026-54649punchin-email is a Cloudflare Email Worker that provides two…2.1
• CVE-2026-5465The Booking for Appointments and Events Calendar – Amelia pl…8.8
• CVE-2026-54650openhole exposes localhost to the internet in one command. I…8.6
• CVE-2026-54651pypdf is a free and open-source pure-python PDF library. Pri…5.5