{"id":"CVE-2026-103671","published":"2026-10-14T09:17:22.030","lastModified":"2026-10-15T20:39:32.067","description":"External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) \"AmazonPay Plugin\". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained.","cvssScore":4.7,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","cwes":["CWE-472"],"vendors":[],"products":[],"references":[{"url":"https://jvn.jp/en/jp/JVN43511918/","tags":[]},{"url":"https://www.ec-cube.net/news/detail.php?news_id=490","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}