CVSS: 7.5EPSS: 0%CPEs: 43EXPL: 1CVE-2009-4060 – CubeCart 3.0.4/4.3.6 - 'ProductID' SQL Injection
https://notcve.org/view.php?id=CVE-2009-4060
SQL injection vulnerability in includes/content/viewProd.inc.php in CubeCart before 4.3.7 remote attackers to execute arbitrary SQL commands via the productId parameter. Una vulnerabilidad de inyección SQL en includes/content/viewProd.inc.php en CubeCart antes de v4.3.7 permite ejecutar comandos SQL a atacantes remotos a través del parámetro ProductID. • https://www.exploit-db.com/exploits/33362 http://forums.cubecart.com/index.php?showtopic=39900 http://osvdb.org/60306 http://secunia.com/advisories/37402 http://www.securityfocus.com/bid/37065 http://www.vupen.com/english/advisories/2009/3290 https://exchange.xforce.ibmcloud.com/vulnerabilities/54331 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.0EPSS: 4%CPEs: 1EXPL: 0CVE-2007-2550
https://notcve.org/view.php?id=CVE-2007-2550
Multiple CRLF injection vulnerabilities in Devellion CubeCart 3.0.15 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a cookie name beginning with "ccSID" to (1) cart.php or (2) index.php. Múltiples vulnerabilidades de inyección de retorno de carro y salto de línea (CRLF) en Devellion CubeCart 3.0.15 permite a atacantes remotos inyectar cabeceras HTTP de su elección y llevar a cabo ataques de ruptura de respuestas HTTP mediante secuencias CRLF en un nombre de una cookie que empieza con "ccSID" a (1) cart.php o (2) index.php. • http://osvdb.org/36209 http://osvdb.org/36210 http://securityreason.com/securityalert/2678 http://www.cubecart.com/site/forums/index.php?s=0cbaa8a2f26fc573d1fc888285f610b1&showtopic=27418 http://www.securityfocus.com/archive/1/467828/100/0/threaded http://www.securityfocus.com/archive/1/468053/100/0/threaded http://www.securityfocus.com/bid/23852 https://exchange.xforce.ibmcloud.com/vulnerabilities/34141 •