https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 16:35:09 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-54644 <p>CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip_tags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data that reaches a GUI message can carry a javascript: URI or event handler through the filter, and viewing or interacting with the rendered anchor executes JavaScript in the victim&#39;s browser session, enabling session exposure or unauthorized application actions. This issue is fixed in version 6.7.5.</p> <p>CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip_tags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data that reaches a GUI message can carry a javascript: URI or event handler through the filter, and viewing or interacting with the rendered anchor executes JavaScript in the victim&#39;s browser session, enabling session exposure or unauthorized application actions. This issue is fixed in version 6.7.5.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-54644