CVE-2013-3654: Lockon Ec-Cube

Medium severity, CVSS 5.0. EPSS: 1.9% chance of exploitation in the next 30 days.

Directory traversal vulnerability in LOCKON EC-CUBE 2.12.0 through 2.12.4 allows remote attackers to read arbitrary image files via vectors related to data/class/SC_CheckError.php and data/class/SC_FormParam.php, a different vulnerability than CVE-2013-3650.

Affected products

• Lockon Ec-Cube: version 2.12.0 only; version 2.12.1 only; version 2.12.2 only; version 2.12.3 only; version 2.12.4 only

Published 2013-06-30. Last modified 2026-06-16.