CVE-2008-4991: Ec-Cube

High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days.

SQL injection vulnerability in LOCKON CO.,LTD. EC-CUBE 2.3.0 and earlier, 1.4.7 and earlier, and 1.5.0-beta2 and earlier; and Community Edition 1.3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the parameter.

Affected products

• Ec-Cube Ec-Cube: up to and including 1.3.5; up to and including 1.4.7; up to and including 1.5.0; up to and including 2.3.0; version 1.3.4 only

Published 2008-11-06. Last modified 2026-06-16.