Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw <?php … ?> into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print.<md5>.php. files/.htaccess ships an explicit <Files print.*.php> allow from all </Files> carve-out, so the file is fetched and executed by any unauthenticated visitor. This vulnerability is fixed in 6.7.3.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-45708 Unauthenticated Remote Code Execution in CubeCart Prior to 6.7.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45708
Post summary
The text announces an unauthenticated remote code execution vulnerability in CubeCart versions before 6.7.3 and directs readers to a vulnerability detail page for more information.
CVE-2026-45708 CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw <?php … ?> into the Invoice Editor. The next time any… https://www.cve.org/CVERecord?id=CVE-2026-45708
Post summary
CVE-2026-45708 exposes CubeCart versions <6.7.3 to remote code execution via the Invoice Editor when an admin with document edit permission saves raw PHP code.