CVE-2025-59413

Katalog CVE

CVSS 6.5 · Medium EPSS 0,40%

Kerentanan Missing Authorization pada cubecart. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber’s email address. This issue has been patched in version 6.5.11.

Rincian

Terbit di NVD

22 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/cubecart/v6/security/advisories/GHSA-869v-gjv8-9m7f exploit · advisory vendor
• https://github.com/cubecart/v6/commit/7fd1cd04f5d5c3ce1d7980327464f0ff6551de79 patch
• https://github.com/cubecart/v6/commit/db965fcfa260c4f17eb16f8c5494e5af4a8ac271 patch
• https://github.com/cubecart/v6/commit/dbc58cf1f7a6291f7add5893b56bff7920a29128 patch