CVE-2026-21719

HighCVSS 8.6/10Last modified Oct 26, 2026

Description

An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to execute an arbitrary OS command.

Metrics

CVSS 4.0 8.6/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
CubeCart Limited	CubeCart	prior to 6.6.0

References

https://community.cubecart.com/t/cubecart-6-6-0-released-the-biggest-update-in-years/62405Release Notes
https://jvn.jp/en/jp/JVN78422311/Third Party Advisory

Timeline

Published: Apr 17, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-21729.8A vulnerability was determined in code-projects Online Application System for Admission 1.0. Affected by this vulnerability is an unknown fu CVE-2026-217207.5Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue l CVE-2026-217218.1The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a CVE-2026-217225.3Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This me CVE-2026-217235.3The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limit CVE-2026-217244.3A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Ed CVE-2026-217252.0A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to CVE-2026-217265.3The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an atta CVE-2026-217273.3A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward c CVE-2026-217287.5Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deploy CVE-2026-217297.5Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deploym CVE-2026-21739.8A vulnerability was identified in code-projects Online Examination System 1.0. Affected by this issue is some unknown functionality of the f