Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

LOCKON EC-CUBECode Injection

Risk 52
Severity
7.5
Code Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

LOCKON EC-CUBE 2.11.2 through 2.12.4 allows remote attackers to conduct unspecified PHP code-injection attacks via a crafted string, related to data/class/SCCheckError.php and data/class/SCFormParam.php.

First published (updated )
CVE-2013-3651

LOCKON EC-CUBEPath Traversal

Risk 26
Severity
5
Path Traversal
AV:N/AC:L/Au:N/C:P/I:N/A:N

Directory traversal vulnerability in LOCKON EC-CUBE 2.12.0 through 2.12.4 allows remote attackers to read arbitrary image files via vectors related to data/class/SCCheckError.php and data/class/SCFormParam.php, a different vulnerability than CVE-2013-3650.

First published (updated )
CVE-2013-3654

LOCKON EC-CUBEPath Traversal

Risk 26
Severity
5
Path Traversal
AV:N/AC:L/Au:N/C:P/I:N/A:N

Directory traversal vulnerability in the lfCheckFileName function in data/class/pages/LCPageResizeImage.php in LOCKON EC-CUBE before 2.12.5 allows remote attackers to read arbitrary image files via vectors involving the image parameter to resizeimage.php, a different vulnerability than CVE-2013-3654.

First published (updated )
CVE-2013-3650

LOCKON EC-CUBEPath Traversal

Risk 26
Severity
5
Path Traversal
AV:N/AC:L/Au:N/C:P/I:N/A:N

Multiple directory traversal vulnerabilities in the doApiAction function in data/class/api/SCApiOperation.php in LOCKON EC-CUBE 2.12.0 through 2.12.5 on Windows allow remote attackers to read arbitrary files via vectors involving a (1) Operation, (2) Service, (3) Style, (4) Validate, or (5) Version value.

First published (updated )
CVE-2013-4702

LOCKON EC-CUBEXSS

Risk 22
Severity
4.3
XSS
AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in the RecommendSearch feature in the management screen in LOCKON EC-CUBE before 2.12.5 allow remote attackers to inject arbitrary web script or HTML via vectors involving the rank parameter, a different vulnerability than CVE-2013-3652.

First published (updated )
CVE-2013-3653

LOCKON EC-CUBEXSS

Risk 22
Severity
4.3
XSS
AV:N/AC:M/Au:N/C:N/I:P/A:N

Cross-site scripting (XSS) vulnerability in data/class/pages/products/LCPageProductsList.php in LOCKON EC-CUBE 2.11.0 through 2.12.4 allows remote attackers to inject arbitrary web script or HTML via vectors involving the classcategoryid2 field, a different vulnerability than CVE-2013-3653.

First published (updated )
CVE-2013-3652

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203