PT-2025-32993 · Unknown · Soosyze Cms

Published 2025-08-13 · Updated 2025-09-02 · CVE-2025-52392

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Soosyze CMS version 2.0

Description: Soosyze CMS version 2.0 is susceptible to brute-force login attacks via the /user/login endpoint. The absence of rate-limiting and lockout mechanisms allows attackers to repeatedly submit login attempts, potentially gaining unauthorized administrative access. This issue corresponds to CWE-307: Improper Restriction of Excessive Authentication Attempts.

Recommendations: Implement rate-limiting on the /user/login endpoint to restrict the number of login attempts within a specific timeframe. Implement account lockout mechanisms to temporarily disable accounts after a certain number of failed login attempts.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2025-52392

GHSA-VQ9X-W82R-RHMC

Affected Products

Soosyze Cms

References · 11

• 🔥 https://exploit-db.com/exploits/52416 · Exploit
• https://osv.dev/vulnerability/GHSA-vq9x-w82r-rhmc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52392 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52392 · Vendor Advisory
• https://github.com/soosyze/soosyze · Note
• https://github.com/soosyze/soosyze/issues/269 · Note
• https://twitter.com/CVEnew/status/1955658279297650884 · Twitter Post
• https://t.me/CVEtracker/29879 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1955667398335283665 · Twitter Post
• https://beafn28.gitbook.io/beafn28/cve/brute-force-login-vulnerability-in-soosyze-cms-2.0-cve-2025-52392 · Note
• https://reddit.com/r/u_HEALSecurity/comments/1n6jswh/weekly_vulnerability_on_the_rise_aug_18_to_aug_24 · Reddit Post