CVE-2013-3651: Lockon Ec-Cube

High severity, CVSS 7.5. EPSS: 4.3% chance of exploitation in the next 30 days.

LOCKON EC-CUBE 2.11.2 through 2.12.4 allows remote attackers to conduct unspecified PHP code-injection attacks via a crafted string, related to data/class/SC_CheckError.php and data/class/SC_FormParam.php.

Affected products

• Lockon Ec-Cube: version 2.11.2 only; version 2.11.3 only; version 2.11.4 only; version 2.11.5 only; version 2.12.0 only; version 2.12.1 only; …

Published 2013-06-30. Last modified 2026-06-16.