OffSec’s Exploit Database Archive - 惯性聚合

推荐订阅源

Microsoft Azure Blog

Cybersecurity and Infrastructure Security Agency CISA

Threat Intelligence Blog | Flashpoint

Vulnerabilities – Threatpost

Know Your Adversary

Threat Research - Cisco Blogs

Cyber Attacks, Cyber Crime and Cyber Security

Tor Project blog

Hacker News: Ask HN

The Exploit Database - CXSecurity.com

博客园 - 三生石上(FineUI控件)

Kaspersky official blog

博客园 - 叶小钗

博客园 - 聂微东

Last Week in AI

博客园 - Franky

美团技术团队

Java Code Geeks

Lohrmann on Cybersecurity

Simon Willison's Weblog

有赞技术团队

Hugging Face - Blog

博客园 - 【当耐特】

宝玉的分享

News and Events Feed by Topic

钛媒体：引领未来商业与生活新知

CTFtime.org: upcoming CTF events

OSCHINA 社区最新新闻

The Blog of Author Tim Ferriss

Security @ Cisco Blogs

Forbes - Security

News | PayPal Newsroom

Stack Overflow Blog

Hacker News: Front Page

Exploit-DB.com RSS Feed

MEmu Android Emulator 9.2.7.0 - Local Privilege Escalation OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive OffSec’s Exploit Database Archive

OffSec’s Exploit Database Archive

Th3-SAx11 · 2026-05-29 · via Exploit-DB.com RSS Feed

# Exploit Title: CubeCart < 6.7.0 - Reflected Cross-Site Scripting 
# Google Dork: intext:"Powered by CubeCart"
# Date: 2026-04-12
# Exploit Author: Th3-SAx11 ( https://github.com/Th3-SAx11 )
# Vendor Homepage: https://www.cubecart.com/
# Software Link: https://www.cubecart.com/download
# Version: 6.x.x
# Tested on: Kali Linux / Windows 10 / Firefox
# CVE: CVE-2026-44376


# Vulnerability Description:
An Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability exists in CubeCart.
The application fails to properly sanitize user-supplied input in the search or catalogue modules 
before outputting it back to the user. An unauthenticated attacker can inject malicious 
JavaScript payloads that will be executed in the context of the victim's browser.

# Proof of Concept (PoC):
1- Go to the Search Bar on the homepage.
2- Enter a product name that has exactly one result (e.g., SAMSUNG) followed by the payload:
          SAMSUNG <script>alert("Test!")</script>
3- Press Enter.
4- Observe the alert box popping up on the screen, confirming the XSS execution.

# Alternative (Direct Link):
https://[TARGET]/cubecart/search?search[keywords]=SAMSUNG%20<script>alert("Test!")</script>&_a=category 


# Important Note for Reproduction
For the payload to execute successfully, the search query must include a valid keyword 
that matches exactly ONE existing product in the store's database (e.g., SAMSUNG). 
If the search returns 0 or multiple products, the payload will not trigger.

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。