CVE-2015-6928: Cubecart

Medium severity, CVSS 6.8. EPSS: 2.2% chance of exploitation in the next 30 days.

classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was made, which allows remote attackers to change the administrator password via a recovery request with a space character in the validate parameter and the administrator email in the email parameter.

Affected products

• Cubecart Cubecart: version 5.2.12 only; version 5.2.13 only; version 5.2.14 only; version 5.2.15 only; version 6.0.0 only; version 6.0.1 only; …

Published 2015-09-28. Last modified 2026-06-17.