CVE-2026-103671

Published: Ott 14, 2026 Last Modified: Ott 14, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM 4,7
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: changed
Confidentiality: none
Integrity: low
Availability: none

Description

AI Translation Available

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) 'AmazonPay Plugin'. If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained.

472

External Control of Assumed-Immutable Web Parameter

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity
Potential Impacts:
Modify Application Data
Applicable Platforms
Technologies: Web Based, Web Server
View CWE Details
https://jvn.jp/en/jp/JVN43511918/
https://jvn.jp/en/jp/JVN43511918/
https://www.ec-cube.net/news/detail.php?news_id=490
https://www.ec-cube.net/news/detail.php?news_id=490