CVE-2025-59412: CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacement
CubeCart is an ecommerce software solution. Prior to version 6.5.11, a vulnerability exists in the product reviews feature where user-supplied input is not properly sanitized before being displayed. An attacker can submit HTML tags inside the review description field. Once the administrator approves the review, the injected HTML is rendered on the product page for all visitors. This could be used to redirect users to malicious websites or to display unwanted content. This issue has been patched in version 6.5.11.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59412?
The severity of CVE-2025-59412 is classified as high due to the potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2025-59412?
To fix CVE-2025-59412, update CubeCart to version 6.5.11 or later, which includes proper sanitization of user inputs.
What impact does CVE-2025-59412 have on CubeCart?
CVE-2025-59412 allows attackers to inject malicious HTML into product reviews, potentially compromising the security of the application.
Who is affected by CVE-2025-59412?
Any user or administrator running CubeCart versions prior to 6.5.11 is affected by CVE-2025-59412.
What kind of attacks can occur due to CVE-2025-59412?
CVE-2025-59412 can lead to cross-site scripting (XSS) attacks, allowing attackers to execute scripts in the context of users' browsers.