CVE-2025-59412 Details
Description
CubeCart is an ecommerce software solution. Prior to version 6.5.11, a vulnerability exists in the product reviews feature where user-supplied input is not properly sanitized before being displayed. An attacker can submit HTML tags inside the review description field. Once the administrator approves the review, the injected HTML is rendered on the product page for all visitors. This could be used to redirect users to malicious websites or to display unwanted content. This issue has been patched in version 6.5.11.
A vulnerability in CubeCart's product reviews feature, present in versions through 6.5.10, allows for HTML injection. User-supplied input is not properly sanitized before being displayed. An attacker can insert HTML tags into the review description. Once the review is approved by an administrator, the injected HTML is rendered on the product page for all visitors. This could be exploited to redirect users to malicious websites or display unwanted content, such as pop-ups or fake messages, potentially harming the site's reputation.
Users can update to CubeCart version 6.5.11 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 22, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cubecart cubecart | < 6.5.11 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 23, 2025 | Initial Analysis | [email protected] |
| Sep 22, 2025 | CVE Modified | CISA-ADP |
| Sep 22, 2025 | New CVE Received | [email protected] |