VulnerableCode Package Details - pkg:composer/ec-cube/ec-cube@4.1.1

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:composer/ec-cube/ec-cube@4.1.1

Essentials
History (1)

purl	pkg:composer/ec-cube/ec-cube@4.1.1

Next non-vulnerable version	4.1.2-p1
Latest non-vulnerable version	4.2.3
Risk	3.1

Vulnerabilities affecting this package (1)

Vulnerability	Summary	Fixed by
VCID-mr5c-68tz-nfbn Aliases: CVE-2022-25355 GHSA-pw97-6v74-9w3p	Missing Authorization EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE users.	4.1.2 Affected by 4 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-02T04:41:40.362088+00:00	GitLab Importer	Affected by	VCID-mr5c-68tz-nfbn	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/ec-cube/ec-cube/CVE-2022-25355.yml	38.6.0