CVE-2026-54646

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.5

Description An issue exists in the admin/sources/maintenance.index.inc.php endpoint where administrator-controlled tablename values are inserted into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without proper validation of identifiers or escaping of embedded backticks. An authenticated administrator can terminate the quoted identifier using a closing backtick to inject structural SQL, which may compromise the confidentiality, integrity, and availability of the database within the application's privileges.

Recommendations Update to version 6.7.5.