CVE-2025-59413

MEDIUM EPSS 29.2%
Published Sep 22, 20259mo ago · Modified Jun 17, 20262w ago
6.5 CVSS 3.1
Medium
Find Similar
Published Sep 22, 2025 9mo ago
Last Modified Jun 17, 2026 2w ago

Description

CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber’s email address. This issue has been patched in version 6.5.11.

CVSS Details

Base Score
6.5
Exploitability
3.9
Impact
2.5
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity Low
Availability Low

Threat Intelligence

EPSS Exploit Probability
29.2% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-862 Missing Authorization Authorization

Affected Products 1

VendorProductVersionRange
cubecartcubecart* <6.5.11

References 4

  • github.com https://github.com/cubecart/v6/commit/7fd1cd04f5d5c3ce1d7980327464f0ff6551de79
    Patch
  • github.com https://github.com/cubecart/v6/commit/db965fcfa260c4f17eb16f8c5494e5af4a8ac271
    Patch
  • github.com https://github.com/cubecart/v6/commit/dbc58cf1f7a6291f7add5893b56bff7920a29128
    Patch
  • github.com https://github.com/cubecart/v6/security/advisories/GHSA-869v-gjv8-9m7f
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/cubecart/v6/commit/7fd1cd04f5d5c3ce1d7980327464f0ff6551de79
    Patch
  • github.com https://github.com/cubecart/v6/commit/db965fcfa260c4f17eb16f8c5494e5af4a8ac271
    Patch
  • github.com https://github.com/cubecart/v6/commit/dbc58cf1f7a6291f7add5893b56bff7920a29128
    Patch