CVE-2025-59411: CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry
CubeCart is an ecommerce software solution. Prior to version 6.5.11, the contact form’s Enquiry field accepts raw HTML and that HTML is included verbatim in the email sent to the store admin. By submitting HTML in the Enquiry, the admin receives an email containing that HTML. This indicates user input is not being escaped or sanitized before being output in email (and possibly when re-rendering the form), leading to Cross-Site Scripting / HTML injection risk in email clients or admin UI. This issue has been patched in version 6.5.11.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59411?
CVE-2025-59411 has been classified as a moderate severity vulnerability due to its potential for HTML injection.
How do I fix CVE-2025-59411?
To fix CVE-2025-59411, upgrade CubeCart to version 6.5.11 or later, which addresses the HTML injection issue.
What kind of attack is possible with CVE-2025-59411?
CVE-2025-59411 allows attackers to submit raw HTML in the Enquiry field, potentially leading to phishing or other malicious exploits.
Who is affected by CVE-2025-59411?
CVE-2025-59411 affects all versions of CubeCart prior to 6.5.11 that use the contact form.
Is there a workaround for CVE-2025-59411?
There is no official workaround for CVE-2025-59411; upgrading to the fixed version is the recommended solution.