CVE-2013-1465: The Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows remote at...

Security readout for executives and security teams

This vulnerability affects older CubeCart 5 stores. A remote attacker could send crafted shipping data that makes the site deserialize attacker-controlled PHP objects. The reported impact includes changing application configuration. For an online store, that creates business risk around storefront integrity, fraud, and operational disruption. Exposure is most likely on internet-facing CubeCart installations running versions 5.0.0 through 5.2.0, especially where basket and shipping functionality remains reachable. The source bundle does not identify affected CPEs or hosting patterns. Treat this as high priority for any active CubeCart 5.0.0 through 5.2.0 storefront. The issue is old, publicly documented, and has public exploit references, but active exploitation is not confirmed by the provided sources. Mitigation focus: Inventory CubeCart deployments and identify any 5.0.0 through 5.2.0 installations.; Check CubeCart vendor guidance for the fixed release or supported remediation path.; Upgrade or retire vulnerable CubeCart instances when vendor guidance confirms remediation..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.