CVE-2026-103671
MEDIUM
NVD
CVSS Score
4.7
Severity
MEDIUM
Published
Oct 14, 2026
Vendor
unknown
Description
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained.