ec-cube ec-cube

Name: ec-cube ec-cube
Brand: ec-cube

productUS

cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

critical

by severity

0critical6high18medium1low

updated 2026-10-23

vulnerabilities (25)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2021-20717US	medium6.1	2.31% (83rd)	Exploit	4.0.5	2021-05-10	4.0.0 → 4.0.5
CVE-2021-20778US	high7.5	2.07% (81st)	—	no fix	2021-07-01	= 4.0.6
CVE-2020-5590US	high8.1	2.06% (81st)	—	no fix	2020-06-19	2 versions
CVE-2023-46845US	high7.2	1.58% (75th)	—	4.2.3	2023-11-07	7 versions
CVE-2021-20750US	medium6.1	1.56% (75th)	—	3.0.18	2021-06-28	4 versions
CVE-2020-5680US	high7.5	1.38% (72nd)	—	no fix	2020-12-03	3.0.5 → 3.0.18
CVE-2021-20841US	medium6.5OT elevated	1.32% (71st)	—	no fix	2021-11-24	2.11.2 → 2.17.1
CVE-2018-16191US	medium6.1	1.30% (70th)	—	no fix	2019-01-09	3.0.0 → 3.0.16
CVE-2006-6108US	medium4.3	1.27% (70th)	—	no fix	2006-11-26	= 1.0
CVE-2008-4534US	high7.5	1.26% (69th)	—	no fix	2008-10-10	5 versions
CVE-2008-4537US	medium4.3	1.22% (69th)	—	no fix	2008-10-10	6 versions
CVE-2008-4535US	medium4.3	1.22% (69th)	—	no fix	2008-10-10	5 versions
CVE-2022-40199US	low2.7	1.19% (68th)	—	3.0.18	2022-09-27	3 versions
CVE-2022-25355US	medium5.3OT elevated	1.16% (67th)	—	3.0.18	2022-02-24	3 versions
CVE-2021-20751US	medium6.1	1.09% (65th)	—	4.0.5	2021-06-28	2 versions
CVE-2008-4536US	medium4.3	1.06% (64th)	—	no fix	2008-10-10	6 versions
CVE-2008-4991US	high7.5	1.06% (64th)	—	no fix	2008-11-06	5 versions
CVE-2023-22438US	medium5.4	0.69% (52nd)	—	no fix	2023-03-06	11 versions
CVE-2022-38975US	medium5.4	0.66% (51st)	—	no fix	2022-09-27	4.0.0 → 4.1.2
CVE-2020-5679US	medium6.1	0.66% (51st)	—	no fix	2020-12-03	3.0.0 → 3.0.18
CVE-2026-30777US	medium6.5OT elevated	0.60% (48th)	—	4.2.3	2026-03-05	6 versions
CVE-2023-25077US	medium5.4	0.56% (46th)	—	no fix	2023-03-06	5 versions
CVE-2021-20842US	medium6.5	0.55% (45th)	—	no fix	2021-11-24	2.11.0 → 2.17.1
CVE-2023-22838US	medium5.4	0.54% (44th)	—	no fix	2023-03-06	5 versions
CVE-2023-40281US	medium4.8	0.42% (35th)	—	2.17.2	2023-08-17	6 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')12 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')2 CVEs
CWE-1021Improper Restriction of Rendered UI Layers or Frames1 CVEs
CWE-20Improper Input Validation1 CVEs
CWE-288Authentication Bypass Using an Alternate Path or Channel1 CVEs
CWE-352Cross-Site Request Forgery (CSRF)1 CVEs
CWE-601URL Redirection to Untrusted Site ('Open Redirect')1 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE25 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan