CVE-2025-59411CWE-79

CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry

Medium · published September 22, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
21.1
In the wild
Unconfirmed
What it is

CubeCart is an ecommerce software solution. Prior to version 6.5.11, the contact form’s Enquiry field accepts raw HTML and that HTML is included verbatim in the email sent to the store admin. By submitting HTML in the Enquiry, the admin receives an email containing that HTML. This indicates user input is not being escaped or sanitized before being output in email (and possibly when re-rendering the form), leading to Cross-Site Scripting / HTML injection risk in email clients or admin UI. This issue has been patched in version 6.5.11.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00296 · 21.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-09-22T16:14Z
EPSS history
Timeline
  • 22 SEP 16:14Z
    CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry
    cvelistv5