PT-2025-38745 · Cubecart · Cubecart

Published 2025-09-22 · Updated 2025-09-22 · CVE-2025-59413

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.5.11

Description A flaw exists in the newsletter subscription functionality that permits unauthorized user unsubscription. An attacker can manipulate the force unsubscribe parameter in a POST request to the newsletter subscription endpoint to remove any valid subscriber’s email address without their consent. The affected endpoint is the newsletter subscription endpoint. The vulnerable parameter is force unsubscribe.

Recommendations Update to version 6.5.11 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-59413

GHSA-869V-GJV8-9M7F

Affected Products

Cubecart

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59413.json · Exploit
• 🔥 https://github.com/cubecart/v6/security/advisories/GHSA-869v-gjv8-9m7f · Exploit
• https://github.com/cubecart/v6/commit/7fd1cd04f5d5c3ce1d7980327464f0ff6551de79 · Patch
• https://github.com/cubecart/v6/commit/dbc58cf1f7a6291f7add5893b56bff7920a29128 · Patch
• https://github.com/cubecart/v6/commit/db965fcfa260c4f17eb16f8c5494e5af4a8ac271 · Patch
• https://osv.dev/vulnerability/CVE-2025-59413 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59413 · Security Note
• https://twitter.com/CVEnew/status/1970167569542684747 · Twitter Post