EC-CUBE CO.,LTD. CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM EC-CUBE CO.,LTD. CVE published 2026-10-14

CVE-2026-103671

An external control of assumed-immutable web parameter issue exists in the EC-CUBE AmazonPay Plugin. If exploited, it may redirect users to arbitrary websites during the ordering process, potentially exposing user account information. EC-CUBE users with the AmazonPay Plugin or V2 Plugin installed, especially those with versions prior to v1.1.13 or v4.3.2, should assess potential exposure and verify their [truncated]