EC-CUBE CO.,LTD. vulnerabilities
Published CVEs affecting EC-CUBE CO.,LTD. products: 2 record(s), with severity, exploitation and fixes.
Ec-cube 1EC-CUBE 4.1 series 1EC-CUBE 4.2 series 1EC-CUBE 4.3 series 1AmazonPay V2 Plugin (4.0/4.1 series) 1AmazonPay V2 Plugin (4.2/4.3 series, Bundle Edition) 1AmazonPay V2 Plugin (4.2/4.3 series) 1AmazonPay Plugin (4.0 series) 1
CVE-2026-103671
Medium · 4.7
CWE-472 Oct 14, 2026
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4...
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained.
CVE-2026-30777
Medium · 6.5
CWE-288 Mar 5, 2026
Authentication Bypass Using an Alternate Path or Channel in EC-CUBE CO.,LTD. Ec-cube
EC-CUBE provided by EC-CUBE CO.,LTD. contains a multi-factor authentication (MFA) bypass vulnerability. An attacker who has obtained a valid administrator ID and password may be able to bypass two-factor authentication and gain unauthorized access to the administrative page.