Critical severity9.1NVD Advisory· Published Feb 19, 2016· Updated May 6, 2026

CVE-2016-1154

Description

SQL injection vulnerability in the Help plug-in 1.3.5 and earlier in Cuore EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Affected products

Cuore/Ec Cube Help Plugin
cpe:2.3:a:cuore:ec-cube_help_plugin:*:*:*:*:*:*:*:*
Range: <=1.3.5

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

jvn.jp/en/jp/JVN31524757/index.htmlnvdVendor Advisory
jvndb.jvn.jp/jvndb/JVNDB-2016-000027nvdVendor Advisory
www.ec-cube.net/products/detail.phpnvd

News mentions

No linked articles in our index yet.

cvss	0.591
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000