यह पृष्ठ अभी तक आपकी भाषा में अनुवादित नहीं हुआ है। हम इस पर काम कर रहे हैं, तब तक अंग्रेज़ी में सामग्री दिखाई जा रही है।
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2026-45714: RCE in CubeCart v6 Ecommerce Software
प्लेटफ़ॉर्म
php
घटक
cubecart-v6
में ठीक किया गया
6.7.0
CubeCart v6, an ecommerce software solution, suffers from a critical Remote Code Execution (RCE) vulnerability. This flaw, stemming from an Authenticated Server-Side Template Injection (SSTI), allows authenticated administrative users to execute arbitrary operating system commands. The vulnerability impacts versions 6.0.0 through 6.6.9 and is resolved in version 6.7.0.
प्रभाव और हमले की स्थितियाँअनुवाद हो रहा है…
The impact of this RCE vulnerability is severe. An attacker, posing as an authenticated administrative user, can gain complete control over the affected CubeCart server. This includes the ability to install malware, steal sensitive data (customer information, payment details, database contents), modify website content, and potentially pivot to other systems on the network. The exploitation pattern resembles classic SSTI attacks, where template engines are misused to execute arbitrary code. Successful exploitation could lead to a complete compromise of the ecommerce platform and associated data, resulting in significant financial and reputational damage.
शोषण संदर्भअनुवाद हो रहा है…
This vulnerability was published on 2026-05-13. Its CRITICAL CVSS score (9.1) indicates a high probability of exploitation. While no public Proof-of-Concept (POC) code has been publicly released as of this writing, the nature of SSTI vulnerabilities makes it likely that exploits will emerge. Monitor security advisories and threat intelligence feeds for any indications of active exploitation campaigns targeting CubeCart installations.
खतरा खुफिया
एक्सप्लॉइट स्थिति
CVSS वेक्टर
इन मेट्रिक्स का क्या मतलब है?
- Attack Vector
- नेटवर्क — इंटरनेट के माध्यम से दूरस्थ रूप से शोषण योग्य। कोई भौतिक या स्थानीय पहुंच आवश्यक नहीं।
- Attack Complexity
- निम्न — कोई विशेष शर्त नहीं। विश्वसनीय रूप से शोषण योग्य।
- Privileges Required
- उच्च — व्यवस्थापक या विशेषाधिकार प्राप्त खाते की आवश्यकता।
- User Interaction
- कोई नहीं — स्वचालित और मूक हमला। पीड़ित कुछ नहीं करता।
- Scope
- बदला हुआ — हमला कमज़ोर घटक से परे अन्य प्रणालियों तक फैल सकता है।
- Confidentiality
- उच्च — पूर्ण गोपनीयता हानि। हमलावर सभी डेटा पढ़ सकता है।
- Integrity
- उच्च — हमलावर कोई भी डेटा लिख, बदल या हटा सकता है।
- Availability
- उच्च — पूर्ण क्रैश या संसाधन समाप्ति। पूर्ण सेवा से इनकार।
प्रभावित सॉफ्टवेयर
कमजोरी वर्गीकरण (CWE)
समयरेखा
- आरक्षित
- प्रकाशित
शमन और वर्कअराउंडअनुवाद हो रहा है…
The primary mitigation is to immediately upgrade CubeCart to version 6.7.0, which addresses the SSTI vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict administrative access to the CubeCart platform and enforce strong password policies. Implement a Web Application Firewall (WAF) with rules to detect and block SSTI attempts, specifically targeting Smarty template injection patterns. Monitor CubeCart logs for suspicious activity, such as unusual template rendering or command execution attempts. After upgrading, confirm the fix by attempting to trigger the SSTI vulnerability through administrative interfaces and verifying that the commands are properly sanitized.
कैसे ठीक करेंअनुवाद हो रहा है…
Actualice CubeCart a la versión 6.7.0 o superior para mitigar la vulnerabilidad de inyección de plantillas del lado del servidor (SSTI). Esta actualización corrige la forma en que se evalúan las plantillas Smarty, evitando la ejecución de comandos arbitrarios en el sistema.
अक्सर पूछे जाने वाले सवालअनुवाद हो रहा है…
What is CVE-2026-45714 — RCE in CubeCart v6?
CVE-2026-45714 is a critical Remote Code Execution (RCE) vulnerability in CubeCart v6 ecommerce software. It allows authenticated administrators to execute arbitrary commands on the server via Server-Side Template Injection (SSTI).
Am I affected by CVE-2026-45714 in CubeCart v6?
Yes, if you are running CubeCart v6 versions 6.0.0 through 6.6.9, you are affected by this vulnerability. Upgrade to version 6.7.0 to resolve the issue.
How do I fix CVE-2026-45714 in CubeCart v6?
The recommended fix is to upgrade CubeCart to version 6.7.0. As a temporary workaround, restrict admin access and implement WAF rules to block SSTI attempts.
Is CVE-2026-45714 being actively exploited?
While no public exploits are currently known, the high severity and ease of exploitation associated with SSTI suggest a high probability of future exploitation attempts.
Where can I find the official CubeCart advisory for CVE-2026-45714?
Refer to the official CubeCart security advisory for detailed information and updates regarding CVE-2026-45714: [https://www.cubecart.com/security/advisories/]
क्या आपका प्रोजेक्ट प्रभावित है?
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।
अभी आज़माएँ — no खाता
scanZone.subtitle
अपनी डिपेंडेंसी फ़ाइल ड्रैग और ड्रॉप करें
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...